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I.  INTRODUCTION 


This  is  the  final  report  for  the  "Hazard  Analysis  of  Pollution 
Abatement  Techniques"  submitted  to  Picatinny  Arsenal,  Dover,  New  Jersey, 
under  Contract  No.  DAAA21-73-C-0771 . 


As  part  of  the  modernization  of  munitions  manufacturing  and  loading 
facilities,  Picatinny  Arsenal  has  been  ascigned  the  task  of  abating 
pollution  stemming  from  various  processes  with  the  objective  of  meeting 
standards  established  by  regulatory  agencies.  Hercules  Incorporated  at 
Allegany  Ballistics  Laboratory  (ABL)  has  performed  a hazards  analysis 
of  four  (4)  proposed  pollution  abatement  techniques  under  this  contract. 


IT.  S.  Army  Armament  Command  ARMCCM  Regulation  No.  AR-50-21, 
formerly  335-22,  requirements^)  outline  the  criteria  for  establishing 


and  implementing  Hazards  Analysis  Techniques  for  concept,  development, 
and  production  phases  for  new  facilities  at  all  USAARMCOM  installations. 
The  aoproach  used  by  ABL  in  assuring  that  all  pollution  abatement  facili* 


ties  studied  meet  these  requirements  stems  from  a practical  quantitative 
approach k2)  to  the  assessment  of  system  operations  through  the  use  of  the 


Hazards  Evaluation  and  Risk  Control  (HERC)  program.  This  approach  is 
quantitative  In  nature  and  utilizes  engineering  measurements  of  both  the 
in-process  energy  and  the  response  of  processed  material  to  this  energy 
to  determine  the  severity  of  hazards  (i.e.,  fires  or  explosions).  These 
data,  coupled  with  a computer  simulation  using  a logic  model  of  the 
system  a r the  format,  provide  the  probability  that  3uch  hazards  occur  in 
the  systems  as  designed. 


The  pollution  abatement  processes  listed  below  were  analyzed  for 
potential  hazards  under  this  contract: 


ADSORPTION  SYSTEMS 


1.  Treatment  of  TNT  Pink  Water  by  Caibon  Adsorption 


The  analysis  of  this  system  was  based  on  the  existing  plant,  at 
Iowa  Army  Ammunition  Plant  (IAAF).  (The  analysis  does  not  include  the 
carbon  regeneration  process.) 


2.  Molecular  Sieve  Adsorption  of  Nitric  Acid  Tail-Gas 


The  basis  of  this  analysis  is  the  treatment  of  off-gases  from  a 
55  ton/day  nitric  acid  plant  at  Holston  Army  Ammunition  Plant  (KAAP) . 

The  system  is  as  described  in  a letter  to  Picatinny  Arsenal  from  Union 
Carbide  Corporation^)  . 


B.  INCINERATION  SYSTEMS 


1.  Fluidized  Bed  Incineration  of  Explosives  and  Propellants 


The  fluidized  bed  to  be  constructed  at  Picatinny  Arsenal  provided 


v^*-Vr~iV  1 1 r 
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the  basia  for  this  analysis. 

2 . Incineration  of  Contaminated  Inert  Waste 

The  prototype  contaminated  waste  incinerator,  as  described  in 
a final  report  by  Uniroyal,  Inc., (5)  and  located  at  Joliet  Army  Ammunition 
Plant  (JAAP),  was  analyzed. 

One  result  of  this  study  is  the  preparation  of  a design  manual, 
(presented  as  Volume  II  of  this  report),  "Manual  of  Hazard  Evaluation 
Criteria  for  Implementing  Pollution  Abatement  Processes  at  Various 
Installations."  This  manual  is  intended  to  provide  design  criteria  (from 
a hazard  viewpoint)  for  the  operation  of  pollution  abatement  processes 
applicable  to  the  systems  presented.  It  indicates  areas  of  concern  that 
would  be  expected  to  lead  to  personnel  injury  or  equipment  damage 
(Categories  I -IV  type  events  as  per  385-22). 

During  the  course  of  this  contract,  the  molecular  sieve  process 
to  be  studied  was  changed  and  rotary  kiln  incinerator  at  Radford  Army 
Acmunition  Plant  (RAAP)  was  deleted  from  the  study.  The  molecular  sieve 
analysis  was  changed  to  a system  which  treated  nitric  acid  tail-gas  fumes 
rather  than  one  which  treated  TNT  nitrator  off-gases  as  originally 
requested.  A subsequent  report  by  RAApW  has  shown  the  potential  hazards 
in  the  TNT  nitrator  molecular  sieve  process.  Consequently,  tail-gas  from 
the  nitric  acid  plant  was  analyzed  in  this  study.  The  rotary  kiln  in- 
cinerator was  deleted  because  a hazards  analysis  had  previously  been 
conducted. 


1-2 


II.  SUMMARY 


A.  OBJECTIVE 

The  objective  of  this  contract  was  to  establish  standards  for 
evaluation  of  the  hazard  potentials  of  two  types  of  pollution  abatement 
processes,  adsorption  and  incineration  systems,  associated  with  U.  S. 

Array  Munitions  facilities.  Two  adsorption  systems  and  two  incineration 
systems  were  studied., 

In  fulfilling  the  objectives  of  this  study,  a manual  for  these 
specific  pollution  abatement  systems  is  being  published  for  future 
distribution  to  Government -Owned  Contractor  Operated  (GOCO)  locations. 

It  includes  a detailed  hazard  analysis  of  the  subject  systems  in  the 
pilot  stage  and  a list  of  additional  hazards  analyses  required  to  convert 
the  processes  to  production  scale  in  compliance  with  ARMCOM  385-22  (AR- 
50-31)  and  MIL -STD -882  . 

B.  METHODS  AND  ANALYSIS  CRITERIA 

The  pollution  abatement  systems  have  been  analyzed  utilizing  the 
proven  HERC  techniques  as  described  in  the  Introduction.  These  analyses 
focus  attention  on  estimating  the  chance  of  occurrence  of  a fire  or 
explosion  which  results  in  equipment  damage  and/or  personnel  injury. 

Design  and  operating  criteria  are  recommended  for  the  pollution  abatement 
processes.  Normal  operations,  startup/shutdown,  emergency  shutdown,  and 
maintenance  operations  which  could  lead  to  the  undesired  fire  or  explosion 
were  considered. 

Failures  described  for  the  various  systems  which  had  a probability  of 
incident  of  > 10"6  per  hour  are  shown  in  Table  II-I.  The  selection  of  1(T6 
probability  is  based  on  the  hourly  average  death  rate  for  each  worker  in 
the  United  States  of  1.6  x 10"6  as  shown  in  the  1973  Accident  Facts  Publi- 
cation, published  by  the  National  Safety  Council  (Chicago,  Illinois).  Thus, 
a criterion  death  rate  of  10"°/hour  assures  that  the  hazard  to  employees 
is  not  greater  than  that  applicable  to  the  average  worker  in  the  United 
States. 

C . RESULTS  AND  CONCLUSIONS 

i . Summary  of  Results  for  each  System 

a.  Carbon  Adsorption  of  TNT  Pink  Water  - The  analysis  of  the 
8 even  principal  process  units  in  the  carbon  adsorption  system  identified 
nine  (9)  sequences,  (see  Table  II-I),  which  have  probabilities  equal  to 
or  greater  than  10  for  a fire  or  explosion  occurring  and  damaging 
equipment  and  killing  or  injuring  personnel.  Five  of  these  sequences 
result  from  maintenance  and  involve  welding  operations  when  the  equipment 
has  not  been  sufficiently  cleaned,  so  that  a dry  layer  of  TNT  remains  on 
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the  equipment.  Another  sequence  involves  a maintenance  operation  in  the 
filter  where  frictional  initiation  is  caused  by  rubbing  of  a tool  over  the 
contaminated  equipment.  Two  impact  initiation  modes  present  hazards  during 
startup/shutdown  operations  when  filling  or  emptying  the  diatomaceous  earth 
filters,  or  when  filling  or  emptying  the  carbon  columns.  Frictional  initi- 
ation modes  can  occur  in  the  filter  due  to  movement  of  diatomaceous  earth 
over  a sufficiently  dry  TNT  layer. 

b.  Molecular  Sieve  Adsorption  of  HNO3  Tail-Gas  - Analysis  of  the 
nine  principal  process  units  in  the  molecular  sieve  system  for  adsorption 

of  nitric  acid  tail-gas  showed  no  probability  greater  than  10"9  for  incident 
which  could  cause  a fire  or  explosion  to  occur  and  result  in  equipment  damage 
and  personnel  death  or  injury.  Thus,  no  unacceptable  hazard  was  identified. 

c . Fluidized  Bed  Incineration  of  Propellants  or  Explosives  ■* 

Analysis  of  the  ten  principal  process  units  used  in  the  fluidized  bed  inciner 
ation  of  propellants  or  explosives  indicated  six  sequences  (see  Table  II-I) 
which  have  probabilities  equal  to  or  greater  than  10"*’  for  the  undesired 
event.  Three  concern  the  pilot  gas  operation  in  the  burner.  The  assumption 
is  made  that  a system  failure  ir  the  feed  line  for  pilot  gas  can  transport 
sufficient  quantify  of  pilot  gas  to  the  burner,  which  would  be  ignited  by 
one  of  three  initiation  sources:  (1)  normally  occurring  fire  in  the  burner, 

(2)  normally  occurring  fire  in  the  preheater,  or  (3)  residual  heat  from  an 
extinguished  fire.  A similar  situation  exists  in  the  fuel  oil  burner.  Each 
of  these  situations  has  a probability  of  10“A, 

d.  Incineration  of  Contaminated  Inert  Wastes.?  Analysis  of  the 
four  principal  process  units  in  the  incineration  of  contaminated  inert 
wastes  indicated  six  sequences  (see  Table  II-I)  for  the  undesired  event 
which  have  a probability  equal  to  or  greater  than  10"&.  These  were  for 
contaminants  having  threshold  initiation  levels  similar  to  Ml  or  N5 
propellant.  For  those  similar  to  TNT,  only  three  sequences  were  id*.  < ' „ied. 
All  but  one  occurred  during  maintenance  operations  in  the  hopper  and  ram 
charger  and  had  probabilities  of  occurrence  of  10"^.  The  explosive  or 
propellant  layer  was  not  removed  prior  to  maintenance  for  these  sequences. 

Two  maintenance  operations  involved  welding  in  each  unit.  The  other  two 
maintenance  operations  involving  sliding  friction  depended  on  the  type  of 
material  in  the  layer.  The  non-maintenance  initiation  source  occurred  in 
the  ram  charger  where  the  heat  from  the  furnace  ignited  the  explosive  or 
propellant  layer  . 

The  probability  of  delivery  of  too  much  natural  gas  or  fuel 
oil  to  the  incinerator  was  considered  to  be  at  least  10"^  for  this  system 
due  to  the  multiplicity  of  burners  in  the  contaminated  waste  incinerator. 

2 . Design  and  Operating  Criteria 

The  recommendations  listed  below  should  be  followed  in  the  design 
and  operation  of  the  systems  studied. 
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a.  Carbon  Adsorption  of  TOT?  Pink  Water  - A careful  check  for 
dry  TNT  should  be  made  before  any  maintenance  operation.  Any  dry  TNT 
layer  irai.Jt  be  removed  before  commencing  said  operation.  ..a  addition, 
contaminated  diatomaceous  earth  should  not  be  handled  in  a dry  condition. 
Spent  carbon,  as  well  as  spent  earth,  should  be  thoroughly  wet  down  prior 
to  the  removal  from  the  process. 

b.  Molecular  Sieve  Adsorption  of  HNOt  Tail-Gas  - No  changes  in 
design  and  operating  criteria  are  required  based  on  the  10"^  probability 
guidelines . 

c . Fluidized  Bed  Incineration  of  Propellants  or  Explosion  - 
Flow  limiters  should  be  installed  m the  fuel  oil  feed  line  to  the  burner 
and  the  pilot  gas  feed  line  to  the  burner  so  that  a line  failure  could 
not  transport  sufficient  fuel  to  the  burner  to  cause  a fi:  a or  explosion. 

d.  Incineration  of  Contaminated  Inert  Wastes  - A careful  check 
should  be  made  before  any  maintenance  operation  to  assure  removal  of  any 
propellant  or  explosives  layer  before  beginning  the  maintenance.  In 
addition,  the  loading  door  interlock  should  not  be  opened  until  the 
temperature  is  less  than  about  100°C. 


3 . Future  Work 


The  following  items  are  suggested  as  areas  where  • cure  work 
would  be  beneficial  to  the  overall  safety  of  adsorption  or  ..ncineration 
pollution  abatement  systems. 

a.  In  the  Carbon  Adsorption  System,  the  process  of  regeneration  of 
spend  carbon  should  be  the  subject  of  a complete  hazards  analysis  since 

the  carbon  will  contain  adsorbed  explosive.  Of  particular  concern  are 
thermal  modes  of  initiation  in  process  where  heat  might  be  used  to 
regenerate  the  carbon.  If  any  consideration  is  given  to  salvaging  or 
regenerating  the  spent  diatomaceous  earth,  this  process  should  be 
analyzed.  Preliminary  material,  response  testing  indicated  that  Bpent 
diatomaceous  earth  is  sensitive  to  initiation  when  dry.  Additional  tests 
should  be  conducted  on  this  material  -In  various  states  of  contamination 
with  explosive  and  wetness.  If  the  system  is  used  with  other  explosives, 
both  spent  carbon  and  spent  earth  should  be  tested  to  characterize  t e 
hazards  involved  in  handling  these  materials. 

b.  In  the  Molecular  Sieve  System,  a complete  hazards  analyois 
should  be  performed  if  the  system  is  to  be  used  for  other  than  treatment  of 
nitric  acid  tail-gas. 

c.  In  the  Fluidized  Bed  Incinerator  System,  an  area  which  should 
be  subjected  to  hazards  analysis  (if  it  has  r.ot  been  previously  analyzed) 
is  the  slurry  preparation  process  which  was  not  within  the  scope  of  this 
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program.  This  process  would  be  expected  to  be  particularly  subject  to 
potential  hazards  if  it  involves  size  reduction  of  explosives  or 
propellants . 

c.  In  the  Contaminated  Inert  Waste  Incineration  System,  It  is 
planned  to  add  an  automatic  feeding  system.  This  system  (conveyors) 
should  be  analyzed  for  potential  hazards. 
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TABLE  II -I 


SUMMARY  OF  CRITICAL  SEQUENCES 


Sequence  of  events  which  could  lead  to  fire  in  a unit  with  a 
probability  of  >10“^ 


Probability  of 
Incident 


System:  Carbon  Adsorption 

Unit:  Carbon  Adsorption  Column 

1.  Welding  on  carbon  adsorption  column  when 
combustible  layer  present  (Thermal) 

2.  Movement  of  carbon  impacts  column  wall  when 
combustible  layer  present  and  surface  not 
wet  (Impact) 

Unit:  Diatomite  Filter 

1.  Movement  of  Diatomite  impacts  filter  vessel 
when  flammable  PEW  present  and  surface  is  not 
wet  (Impact) 

2.  Maintenance  man  rubs  tool  over  PEW  layer 
(Friction) 

3.  Diatomite  moves  over  PEW  layer  (Friction) 

4.  Welding  on  Diatomite  filter  when  PEW  layer 
present  (Thermal) 

Unit:  Circulating  Pump 

1,  Welding  on  circulating  pump  when  PEW  layer 
present  (Thermal) 

Unit:  Settling  Tank 

1.  Welding  on  tank  when  PEW  present  (Thermal) 

Unit:  Sump  Pump 

1.  Welding  on  sump  pump  when  PEW  present  (Thermal) 


nr6 

10“6 


10-3 

10“6 


10 


-5 


10“4 
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TABLE  II-I  (Cont'd) 

Sequence  of  events  which  could  lead  to  fire  in  a unit  with  a probability 
of  >1CT6 


Probability  of 
Ir.c  id  ent 


System:  Molecular  Sieve  System 


iJone 


System: 

Fluidized  Bed  Incinerator 

Unit: 

Burner 

1.  There  is  a fire  in  adjacent  unit  when  there 
is  sufficient  flamnable  fuel  oil  present. 

1 

o 

r— < 

2.  There  is  a normally  occurring  fire  in  the 
burner  when  there  is  sufficient  flammable 
fuel  oil  present . 

t 

o 

rW 

3.  There  is  residual  heat  in  the  burner  when 
there  is  flammable  fuel  oil  present. 

10-4 

4.  There  is  a fire  in  adjacent  unit  when  there 
is  sufficient  pilot  gas  in  burner. 

10-4 

5.  There  is  a normally  occurring  fire  in  the 
burner  when  there  is  sufficient  pilot  gas. 

10-4 

6.  There  is  residual  heat  present  in  burner 
when  flammable  pilot  gas  is  present. 

I-1 

o 

i 

System: 

Inert  Waste  Incinerator 

Unit: 

Hopper 

1.  During  maintenance,  tooi  is  rubbed  over 
contaminated  surface  (Friction) , 

10-4 

2 . Welding  is  performed  on  hopper  when 

sufficient  PEW  Layer  is  present  (Thermal). 

10"4 

Unit : 

Charger 

1.  During  maintenance,  tool  rubs  over  contami- 
nated surface. 

1 

o 
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TABLE  II-I  (Cont'd) 

„.i 

Sequence  of  events  which  could  lead  to  fire  in  a unit  with  a probability 
of  >10-6 

Probability  of 
Incident 

2.  Welding  is  performed  on  charger  when  10“^ 

sufficient  PEW  layer  exists. 


3.  Fire  in  an  adjacent  unit  when  there  is  a 
sufficient  PEW  layer. 

4.  Residual  heat  in  charger  when  there  is  a 
sufficient  '.PEW  layer. 


i 
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III.  DISCUSSION 


A.  METHODOLOGY 

Hazards  analyses  were  performed  on  four  pollution  abatement  systems 
using  the  HERC  technique  previously  described.  These  systems  were, 

(1)  carbon  adsorption  of  TNT  pink  water,  (2)  molecular  sieve  adsorption 
of  nitric  acid  plant  tail-gas,  (3)  fluidized  bed  incineration  of  pro- 
pellant or  explosive  material  and  (4)  incineration  of  contaminated  inert 
wastes . 

Initial  phases  in  this  study  included  identification  of  potentially 
hazardous  in-process  materiris  and  possible  initiation  modes,  as  well  as 
development  of  a logic  raodei  for  each  process,  and  computer  simulation 
of  the  logic  models.  The  selection  of  potentially  hazardous  in-process 
materials  is  discussed,  along  with  the  potential  initiation  modes,  under 
each  abatement  process.  The  development  of  the  logic  models  and  a brief 
description  of  the  computer  program  used  to  simulate  the  logic  model  is 
presented  in  the  Appendix  with  the  logic  models. 

1.  In-Process  Potentials 


In-process  potentials  were  calculated  whenever  possible  for 
each  initiation  source.  Some  potentials  were  not  practical  to  calculate 
and  were  shown  as  being  undefined  although  they  were  assumed  to  be 
sufficient  to  cause  initiation  when  sufficient  fuel  is  present.  These 
potentials  include:  (a)  electrical  power  discharge  from  faulty  electri- 

cal tools,  (b)  faulty  electrical  instruments  or  controls,  (c)  faulty 
electrical  process  units,  and  (d)  impact  caused  by  loose  parts 
vibration. 

Other  impact  potentials  were  defined,  such  as  dropping  a bolt 
or  a hand  tool,  or  impacting  tramp  material  in  an  operating  blower. 
Calculations  for  these  impact  energies  were  based  on  data  from  Radford 
Arr.y  Ammunition  Plant  (RAAP)^^  and  data  at  Allegany  Ballistics  Labo- 
ratory (ABL) ' The  most  severe  in-process  potential  was  reported 
when  a choice  existed. 

Frictional  in-process  energies  were  assumed  to  be  equal  to  at 
least  the  yield  strength  of  the  material  of  construction,  and  in  some 
applications  three  times  the  yield  strength  was  used.  To  be  con- 
servative, stainless  steel  was  assumed  when  the  material  of  the  process 
unit  was  not  known.  It  was  estimated  that  stress  loads  could  be  applied 
at  velocities  of  2 ft/sec  during  maintenance.  Velocities  due  to  other 
sources  were  calculated  for  the  equipment  under  consideration.  In 
cases  of  gas  particulate  flow,  gas  velocity  was  used,  as  if  there  were 
no  slip  between  gas  and  the  particles  it  carried. 
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In-process  energies  due  to  thermal  sources  were  based  on  the 
maximum  expected  temperatures.  The  maximum  temperature  attained  during 
welding  is  approximately  3600°C.  A similar  temperature  would  be  expected 
if  a fire  occurred  in  an  adjacent  unit.  The  maximum  temperature  assumed 
for  overheated  bearings  is  1500°G  (approximately  the  melting  point  of 
ste^l) . The  temperature  for  residual  heat  was  assumed  as  the  normal 
temperature  for  the  operation,  when  appropriate.  For  an  overheated 
electrical  element,  a temperature  of  1177°C  was  based  on  data  in  the 
'Material  Handbook"  by  Brady  i8'  . 

ESD  ignition  modes  were  classified  under  two  basic  categories. 

The  first  was  human  ESD,  and  its  maximum  energy,  O.OISJ^*',  was  con- 
sidered as  the  in-process  potential.  The  other  w~n  airveying  material. 
The  "rule  of  thumb"  value,  Q.Q25J,  used  by  Palmer  in  his  recent  book^®) 
was  assigned  to  any  airveying  material  when  no  better  data  were  available. 

Impingement  potentials  were  evaluated  at  the  expected  gas 
velocity.  This  is  a conservative  approach  since  the  particle  or  tramp 
material  velocity  is  always  lower  than  the  velocity  of  the  gas  which  is 
propelling  the  solid  material. 

2 . Safety  Margin 

The  initiation  safety  margin  calculated  in  this  study  is  a ratio 
that  defines  the  fraction  that  the  threshold  initiation  energy  is  greater 
than  the  in-process  potential.  The  definition  is: 


SM  ■-  (rcaterial  response)  - (process  potential) 

(process  potential) 

or  SM  = (material  response)  _ ^ 

(process  potential) 

Safety  margins  have  two  purposes.  They  shew  where  the  immediate 
problems  are  that  require  further  attention.  For  example,  if  a system 
analysis  reveals  that  of  fen  potentially  hazardous  conditions,  nine 
exhibit  safety  margin  values  greater  than  100,  and  one  has  a safety  margin 
of  three,  then  obviously  the  effort  should  be  directed  towards  this  latter 
condition.  The  safety  margin  also  provides  a means  for  estimating  the 
probability  of  occurrence  of  an  event (7). 

Analysis  based  on  safety  margin  is  conservative  since  maximum 
expected  in-proceBS  potentials  are  used  with  minimum  required  ignition 
energies . 


The  conversion  from  safety  margin  to  probability  of  initiation  is 
shown  in  Table  III-I.  Different  conversions  exist  for  different  initi- 
ation modes  except  that  the  conversions  for  impact  and  electrical  modes  are 
the  same.  It  should  be  noted  that  the  conversions  provide  a "best  estimate" 
although  they  are  not  exact,  e.g.,  for  the  frictional  mode,  a safety  margin 
between  four  and  eight  give3  e probability  of  initiation  of  10-6. 
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Safety  Afcrsrin  vs  Probability  of  Initiation 
V»hen  Sufficient  Xu  el  la  Present 


i.  Frictional  Mode 


II. 


111. 


IV, 


Safety  Margin 

Probability  of  Initiation 

^ 0 

0 

1 

2r3 
4-3 
9 
> 9 

Impact  or  Electrical  Mode 
Safety  Margin 

1.0  0 
3x10“*' 

2xlO“J 

io-S 

10~6 

5xl0“7 

10"7 

(ESD) 

Probability  of  Initiation 

< 0 

1.0  o 

0 

3.X  lO*2* 

1 

6x10*5 

2- 3 

io:5 

4-7 

10  B 

8-19 

10-8 

> 19 

10~9 

Thermal  Mode 

Safety  Margin 

Probability  of  Initiation 

< 0 

1.0  o 

0 

3x10*** 

1 

■Jt 

6x10*® 

2. 

10  a 

3 

10"8 

4-6 

10“9 

7-g 

10-10 

>9, <39 

10-11 

>19 

lO-l® 

Impingement  Mode 

Safety  Margin 

Probability  of  Initiation 

< 0 
0 
1 
2 


1*°.« 
3X1°  ‘ 
5x10-1 | 
10"16 
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Guidelines  for  Probabilities 


It  was  previously  stated  that  the  purpose  of  this  effort  is  the 
identification  of  potential  hazards  in  the  systems  being  analyzed.  For 
this  work,  the  hazard  to  be  identified  is  any  set  of  circumstances  which 
may  lead  to  the  undesired  event,  "fire  or  explosion  causes  injury  or  death 
to  personnel  or  damage  to  equipment."  The  existence  of  such  a set  of 
circumstances  is  probabilistic  in  nature,  so  the  probability  of  occurrence 
of  each  element  which  contributes  to  potential  hazard  is  assigned  a 
numerical  value  in  order  to  form  a basis  for  the  analysis. 

The  overall  probability  of  occurrence  of  the  undesired  event  is 
calculated  as  the  product  of  three  basic  probabilities,  (P  = Pg  x P^p  x Pj,) 
where 


P = Overall  probability  of  the  undesired  event. 

Pg  = Probability  that  an  event  will  occur. 

P^p  = Probability  that  combustible  will  be  present. 

Pj  a Probability  that  an  initiation  stimulus  of  sufficient 
energy  will  occur. 

(Refer  to  Figure  III-l,  page  III-5,to  see  how  these  items  are  shown  in 
the  analysis  fact  sheets,  which  appear  in  Tables III-II  through  III-XXXI  for 
the  systems  analyzed.) 

Discussion  of  the  assignment  of  values  to  the  basic  probabilities 
appears  below. 

The  numerical  value  assigned  to  a probability  cannot  usually  be 
assumed  to  be  precise,  since  the  assigned  values  are  often  the  result  of 
statistical  treatment  of  test  data  or  accumulated  historical  data  from 
operations  performed  over  a significant  period  of  time  or  significant 
number  of  operation  cycles.  Since  there  are  practical  limitations  on  the 
accuracy  of  tests  performed,  and  it  is  possible  for  historical  data  to  be 
incomplete,  or  data  may  have  been  collected  from  operations  or  equipment 
similar  to  but  not  the  same  as  that  being  considered  in  an  analysis,  the 
statistical  treatment  of  data  is  usually  biased  in  the  direction  of 
conservatism.  The  best  values  available  to  the  analyst  at  the  time  the 
work  was  done  were  used  in  this  analysis. 

a.  Probability  that  an  event  will  occur 

Each  event  considered  is  classified  as  normal  or  abnormal. 

Normal  events  are  assigned  a value  of  ane  for  probability  of  occurrence. 

This  applies  to  any  event  that  occurs  as  a normal  part  of  an  operation. 

Unusual  events  are  those  that  do  not  occur  in  the  normal 
process.  The  value  of  probability  for  unusual  events  is  usually  less 
than  one.  Examples  of  unusual  events  are  mechanical  and  electrical 
failures  and  human  failures.  The  preferred  basis  for  assignment  of  proba- 
bility values  to  these  events  is  historical  data.  The  probability  is 
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calculated  by  dividing  the  number  of  failures  observed  by  the  number  of 
hours  of  operation  during  which  the  failures  occurred,  or  if  the  operation 
Is  cyclical,  the  number  of  observed  failures  is  divided  by  the  number  of 
cycles  of  operation  during  which  the  failures  occurred. 

If  historical  data  are  not  available,  the  probability  value 
may  be  assigned  on  the  basis  of  guidelines  developed  from  other  sources. 
Ground  rules  used  to  establish  some  of  the  event  probabilities  in  this 
analysis  are  listed  below: 


(1)  A probability  of  10”^  is  designated  for  events  which 
occur  due  to  procedural  errors,  such  as  the  failure  of  an  operator  or 
maintenance  man  to  follow  a routine  procedure.  This  value  was  established 
by  examination  of  operating  records  for  several  Hercules  plants  for  a 
"Zero  Defects"  program  evaluation. 


(2)  A probability  of  10"^  to  lCT^  is  applied  to  accidental 
situations  resulting  from  human  failure,  with  the  specific  value  chosen 
dependent  on  factors  such  as  operator  experience,  complexity  of  operation, 
or  work  area  situation  (crowded,  cluttered,  noisy,  hot,  etc.). 

(3)  A probability  of  10'^  is  assigned  to  both  mechanical 
and  electrical  failures.  The  data  used  to  establish  these  is  from 
FARADS  publications,  using  data  for  several  types  of  mechanical  and 
electrical  equipment . 


b.  Probability  that  combustible  is  present 

The  presence  of  combustible  or  fuel,  may  be  normal  or  ab- 
normal for  a specific  equipment  or  operation.  If  its  presence  is  normal, 
the  probability  value  assigned  is  one,  but  if  it  is  abnormal,  the  proba- 
bility value  is  usually  less  than  one.  Assignment  of  a probability  to 
the  abnormal  presence  of  a fuel  is  similar  to  the  assignment  of  proba- 
bility to  an  abnormal  event,  previously  discussed,  except  the  existence 
of  accurate  historical  data  is  less  likely. 


c.  Probability  of  Initiation 


The  preferred  method  of  assignment  of  the  probability  of 
initiation  is  by  use  of  the  problt  technique.  This  technique  utilizes 
test  data  which  is  subjected  to  a regression  analysis  from  which  a 
probit  plot  is  developed.  This  plot  makes  available  the  probability 
of  initiation  as  a function  of  process  energy. 


A second  technique  for  assignment  of  probability  of  initi- 
ation is  by  use  of  the  calculated  safety  margin  as  shown  in  Table  III-l. 
The  method  of  calculating  probability  of  initiation  from  margin  of  safety 
data  is  analogous  to  determining  reliability  for  stress-strain  problems 
as  described  in  published  reliability  texts,  such  as  "Lloyd  and  Lipow"(21) . 

In  this  program,  each  hazard  identified  was  evaluated  against 
a criteria  of  10“6  probability  of  occurrence,  A potential  hazard  for 


III-7 


mmrntmmii  r a&aaa 


which  the  probability  of  occurrence  is  less  than  10“®  is  considered 
acceptable,  and  one  for  which  it  is  greater  than  10"^  is  considered  un- 
acceptable. This  criterion  is  based  on  the  average  hourly  death  rate 
for  each  worker  in  the  United  States  (1.6  x 10”6)  as  shown  in  the  1973 
Accident  Facts  publication  of  the  National  Safety  Council.  Use  of  this 
criterion  assures  that  the  hazard  to  employees  who  work  with  the  systems 
under  consideration  is  not  greater  than  that  applicable  to  the  average 
worker  in  the  United  States . 

4.  Hazard  Analysis  Summary  Tables 

The  sequence  of  events  that  can  potentially  cause  a problem  in 
the  pollution  abatement  system  or  any  system  follows  a logical  paetern. 
For  the  defined  event  to  occur,  several  conditions  must  be  met;  (1)  a 
combustible  material  must  be  present  , (2)  initiation  stimulus  imiat  be 
present  and  (3)  the  combustible  material  will  produce  a response  to  the 
stimulus.  The  potential  hazards  identified  in  this  analysis  have  been 
summarized  in  tables  and  are  mentioned  in  the  discussion  of  each  equip- 
ment analyzed,  which  follows.  The  location  of  the  data  on  the  tables 
are  outlined  in  Figure  III-l. 

Potential  hazardous  events  were  defined  by  logic  modeling, 
therefore,  the  summarized  events  are  indexed  with  logic  model  reference 
numbers.  The  numbers  correspond  to  the  logic  model  as  shown  in  the 
example  tree,  Figure  II1-2 . 


B.  CARBON  ADSORPTION  OF  TNT  PINK  WATER 

, At  all  facilities  which  use  TNT,  TNT  may  be  spilled  and  washed 
down  with  water,  or  removed  from  material  in  process  during  washing 
operations.  This  TNT  contaminated  water  has  been  disposed  of  by  dumping 
into  local  streams.  In  the  carbon  adsorption  system,  waste  water  is 
subjected  to  a ( -step  treatment.  It  is  first  filtered  in  a diatomaceous 
earth  filter  to  remove  suspended  solids  and  then  filtered  through  carbon 
columns  to  remove  dissolved  TNT. 

The  carbon  adsorption  system  analyzed  was  based  on  the  existing  plant 
at  Iowa  Army  Ammunition  Plant  (IAAP),  but  at  the  request  of  Picatlnny 
Arsenal,  did  not  include  the  regeneration  pi'ocess.  The  system  analyzed 
consists  of  carbon  adsorption  columns,  diatomite  filter,  circulating  pump, 
settling  tank,  sump  pump,  sump  and  floor  drain  system  (as  partially 
depicted  in  Figure  III-3) . 

A similar  system  at  Joliet  Army  Ammunition  Plant  (JAAP)  was  also 
viewed  for  general  information.  The  primary  difference  between  the  two 
facilities  is  the  method  of  removing  spent  carbon  and  spent  diatomaceous 
earth.  JAAP  pumps  out  the  spent  material  with  water  and/or  air  into 
trucks  for  subsequent  disposal,  while  IAAP  manually  shovels  out  the  spent 
material  into  aluminum  buckets  . 
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A single  fuel  source  was  considered  for  the  undesired  event  - "fire 
or  explosion  results  in  personnel  death  or  injury,  or  equipment  damage." 

It  was  a layer  of  sufficiently  dried  TNT  or  its  accompanying  nitrobodies 
in  a process  unit.  In  its  normal  state  in  this  system,  TNT  is  highly 
dilute  and  results  in  no  hazard.  However,  a more  concentrated  form,  or 
a dried  out  layer  can  create  a hazard.  Five  initiation  modes  were  con- 
sidered for  the  sufficiently  dried  layer.  They  were  impact,  friction, 
thermal,  ESD,  and  electrical  power  discharge.  Impact  initiation  threshold 


ranged  from  31.6  ft-lb/in^  for  dry  TNT  to  more  than  72  ft-lb/in^  for  settled 
TNT  (25-30%  H20).'^»^'  Frictional  threshold  initiation  for  dry  TNT  was  at 
190  kpsi  at  2 ft/sec'  '*  ' velocity  and  for  settled  (wet)  TNT  was  more  than 
77.5  kpsi  at  8 ft/sec  velocity.'14 » At  2 ft/sec  the  settled  TNT  should  be 
more  than  190  kpsi^14*1-^'  since  the  presence  of  water  should  increase  the 
threshold  level.  For  thermal  initiation.  (?3ta  existed  only  for  dry  TNT. 
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more  than  190  kpsi'14,iJ'  since  the  presence  of  water  should  increase  the 
threshold  level.  For  thermal  initiation.  (?9ta  existed  only  for  dry  TNT. 

Its  autoignition  temperature  was  230°Cl1'  * ■L^'.  Wet  TNT  would  have  an  auto- 
ignition temperature  in  excess  of  this  value.  For  electrical  ignition,  TNT 
can  be  Ignited  by  0.075J'^  »^3)  , while  water  wet  TNT  requires  1 .26J'14  * . 

Preliminary  testing  of  spent  diatomaceoua  earth  samples  received  from 
JAAP  indicate  that  the  material  is  insensitive  to  initiation  when  wet 
(-'50%  H2O)  . The  wet  sample  did  not  ignite  and  propagate  a reaction  from  a 
J-2  cap  donor.  The  dry  spent  diatomaceous  earth  (-'  7-8%  TNT)  is  sensitive 
to  initiation  and  may  result  in  localized  initiations.  This  is  due  primarily 
to  the  lumps  of  TNT  it  contains,  which  react  in  the  same  manner  as  pure  TNT. 

A dried  sample  of  the  spent  carbon  received  from  JAAP  was  much  less  sensitive, 
probably  because  of  the  lower  amount  of  TNT  present,  -'2.5%  by  weight.  The 
as  received,  water-wet  samples  were  insensitive  to  initiation  by  either 
impact  or  friction.  Test  results  are  shown  below: 

Threshold  Initiation  Level  (20  Tests) 
Impact*  Friction  * ESD 

Sample  ft-lb/in^  psi  at  8 fps  joules 


Sample 
As  Received: 

Spent  Carbon  (24%  TV) 

Sper.t  Diatomaceous  Earth 
(58%  TV) 


>115,300 

>114,500 


Spent  Carbon 

Spent  Diatomaceous  Earth 


103,000 
@ 2 fps 
103,000 


0.075 


*A11  impact  and  sliding  friction  utilized  steel  on  steel 
components . 

1 . Carbon  Adsorption  Columns 

Two  identical  carbon  columns  are  each  packed  with  activated  carbon 
which  adsorbs  dissolved  TNT  from  the  water  in  the  final  process  steps.  Water 
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from  tho  filter  enters  the  bottom  of  the  bed  and  flows  chrough  the  bed. 

The  effluent  from  the  first  column  flows  to  the  bottom  of  the  second 
column  where  the  adsorption  process  is  repeated  and  the  water  discharged 
to  the  sewer.  Either  column  can  receive  flow  from  the  filters,  thus 
ensuring  that  the  last  column  will  have  the  freshest  carbon.  The  columns 
are  typically  serviced  when  they  do  not  produce  water  with  less  than  5 ppm 
TNT. 


Analysis  of  the  logic  model  has  Identified  2C  minimum  sequences 
of  event  which  could  cause  the  undesired  event.  Ten  each  came  from  two 
different  independent  sequences  (probabilities  of  10"6  and  10"^,  respective- 
ly) by  which  a sufficiently  dry  TNT  or  nitrobody  layer  could  be  produced. 

Two  of  the  20  cut-sets  had  probabilities  equal  to  or  greater  than  10“6. 

These  were  (l)  the  impact  of  carbon  onto  a combustible  layer  when  filling  or 
emptying  the  vessel,  and  (2)  welding  operation,  assuming  the  maintenance  man 
does  not  check  and  remove  the  combustible  layer.  A summary  of  the  various 
ignition  modes  with  their  safety  margins  and  probabilities  and  the  maximum 
probability  for  the  existence  of  sufficiently  dry  combustible  layer  is  shown 
in  Table  III-II. 


A check  of  the  vessel  prior  to  filling  or  emptying  or  a welding 
operation  would  decrease  the  probability  of  the  undesired  events  to  about 
10““,  provided  that  any  layer  would  be  subsequently  removed.  ThiB  would 
then  be  an  acceptable  hazard. 


2 . Diatomite  Filter 


The  cylindrically-shaped  filter  has  dished  ends  and  is  mounted 
vertically  on  legs.  Its  removable  toi  is  supported  by  a swivel  arrangement 
to  allow  the  lid  to  be  raised  and  swung  to  the  side  when  servicing  Circular 
stainless  steel  cartridges  mounted  at  the  top  of  a vertical  pipe  support  the 
filtering  media.  Each  cartridge  consists  of  an  upper  perforated  plate 
fastened  to  a lower  solid  dish  filled  with  baffles.  A polypropylene  bag 
surrounds  each  cartridge  and  is  used  to  form  a base  for  the  diatomaceous 
earth  filtering  media.  When  the  filter  is  serviced,  the  plates  and  support- 
ing pipe  are  lifted  from  the  filter  vessel  by  a crane. 

During  operation,  waste  water  and  diatomaceous  earth  enter  the  filters, 
and  flow  over  the  cartridges.  Water  flows  through  the  earth  layer  and  leaves 
through  holes  in  the  supporting  pipe  at  the  center  of  the  filter.  This 
effluent  water  normally  is  free  of  suspended  particles  and  contains  only 
dissolved  TNT.  Under  normal  operations,  the  filter  becomes  clogged  such  that 
periodic  cleaning  is  required. 


Analysis  of  tl.e  logic  model  showed  22  sequences  of  independent  events 
(minimum  cut-sets)  which  could  generate  the  undesired  event.  Eleven  came  from 
each  of  two  different  independent  sequences  (probabilities  of  10’3  and  10  , 

respectively)  by  which  a sufficiently  dry  combustible  layer  could  be  produced. 
Four  had  probabilities  equal  to  or  greater  than  10"6.  They  were  (1)  impact 
initiation  from  diatomaceous  earth  when  sufficiently  dry  layer  is  present 
during  filling  or  emptying  the  filter,  (2)  frictional  initiation  during 
maintenance  when  metal  is  rubbed  over  a sufficiently  dry  combustible  layer, 
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(3)  frictional  initiation  from  movement  of  diatomaceous  earth  when  a 
combustible  layer  is  sufficiently  dryj  and  (4)  thermal  initiation  during  a 
welding  operation  when  combustible  layer  is  sufficiently  dry.  This  latter 
operation  assumes  that  the  maintenance  man  does  not  check  for  and  subse- 
quently remove  the  dried  combustible.  A summary  of  the  various  ignition 
modes  with  their  safety  margins  and  probabilities,  and  the  maximum 
calculated  probability  for  the  existence  of  sufficiently  dry  combustible 
layer  is  shown  in  Table  Ill-Ill. 


£'  A careful  check  for  dry  combustible  and  its  removal  (if  any 

| > exists)  before  commencing  either  of  the  four  hazardous  operation 

h:,  mentioned  in  the  preceding  paragraphs  will  lower  the  event  probability  to 

{(•'.  less  than  10“®,  decreasing  the  probability  of  any  of  the  events  by  10“5 . 

f;  The  spent  earth  should  not  be  allowed  to  become  completely  dry,  since  this 

|,'  material  ia  more  sensitive  in  some  respects  (e.g.,  impact)  than  TNT. 

$k- 

| , 3.  Circulating  Pump 

p,  The  circulating  pump  moves  the  contaminated  water  from  the  settling 

& tanks  to  the  dlatomite  filters. 


Analysis  of  the  logic  model  has  identified  22  sequences  of  events 
(minimum  cut-sets),  which  could  create  the  undesired  event.  Eleven  came 
from  each  of  two  different  independent  sequences  (probabilities  of  10“^ 
and  10“9,  respectively)  by  which  a sufficiently  dry  combustible  layer  could 
be  produced.  Only  one  had  a probability  equal  to  or  greater  than  10"6.  It 
was  welding,  assuming  such  maintenance  is  needed,  when  a sufficiently  dry 
combustible  layer  is  present.  (The  further  assumption  is  made  that  the 
maintenance  man  does  not  check  and  remove  such  a combustible  layer  before 
making  the  repair.)  A summary  of  the  different  initiation  modes  with  their 
safety  margins  and  probabilities  is  shown  in  Table  I1I-1V  along  with  the 
maximum  probability  calculated  for  the  existence  of  a sufficiently  dry 
combustible  layer. 

A check  of  the  vessel  prior  to  the  welding  operation  would  decrease 
the  probability  of  the  event  to  about  10“9,  assuming  that  any  hazardous  layer 
would  be  removed,  Thi3  would  then  be  an  acceptable  hazard. 

4 

4.  Settling  Tank 

Two  large  settling  tanks  hold  the  contaminated  liquid  that  comes 
from  the  sump  pumps  in  order  to  separate  the  solids  from  the  water. 

Sixteen  minimum  cut-sets  which  could  create  the  undesired  event  were 
identified  by  analysis  of  the  logic  model.  Two  different  independent 
sequences  (with  probabilities  of  10"®  and  lO'^O,  respectively)  were  shown 
in  the  model  by  which  a sufficiently  dry  combustible  layer  could  be  pro- 
duced; each  generated  eight  of  the  16  cut-sets,  Only  one  had  a probability 
of  10"®  or  more.  It  again  involved  a welding  operation  when  a sufficiently 
dry  combustible  layer  is  present.  The  assumption  was  again  made  that  the 
maintenance  man  did  not  check  for  and  remove  the  combustible  layer. 


■v.--'  ;t»-  .Jtiff,.  /.«*«■.  &.VK.A 


,r'.-' '.ryvm'rf  *’'■'<  ‘v»r'w-  • • i • 


T \ '•  >-|,^'V’»|T. 


Different  initiation  modes  with  their  safety  margins  and  probabilities 
are  summarized  with  the  calculated  maximum  probability  for  the  existence 
of  a sufficiently  dry  combustible  layer  in  Table  II1-V. 

A check  of  the  tank  and  subsequently  removal  of  the  combustible 
layer  (when  present)  would  be  required  to  lower  the  welding  hazard  proba- 
bility to  10*10. 

5 . Sump  Pump 

The  sump  pump  propels  contaminated  water  from  the  sump  to  the 
settling  tank.  The  overall  analysis  is  the  same  as  the  circulating  pump 
previously  mentioned.  A summary  table  for  initiation  modes  and  existence 
of  a combustible  layer  in  this  unit  is  shown  in  Table  XII -VI. 

6.  Sump  Tank 

The  sump  tank  collects  waste  water  from  the  floor  drains.  It  is 
cleaned  on  a weekly  basis.  Maintenance  personnel  equipped  with  explosion 
proof  tools  enter  the  sump  and  shovel  the  TNT  onto  waiting  trucks  after 
the  sumps  have  been  pumped  to  their  lowest  point . 

Sixteen  minimum  cut-sets  were  identified  by  computer  simulation 
resulting  from  two  sources  of  sufficiently  dry  combustible  layers  (proba- 
bilities of  10"5  and  10“^,  respectively)  . None  had  a probability  of  the 
undesired  event  greater  than  10“®.  A probability  of  10"5  (accidental)  was 
assigned  to  the  existence  of  a sufficiently  dried  combustible  layer  since 
extreme  care  is  reported  to  be  presently  used  during  normal  cleanup 
operations,  and  the  same  care  would  be  expected  when  welding.  A summarizing 
table  is  presented  for  initiation  modes  and  existence  of  a flammable  layer 
in  Table  III -VII. 

7 . Floor  Drains  (Trench) 

The  floor  drains  collect  waste  water  and  channel  it  to  the  sump. 

Eighteen  minimum  cut-sets  that  could  cause  the  undeslred  event  were 
identified  by  analysis  of  the  logic  model.  This  results  from  two  independent 
sources  of  obtaining  a sufficiently  dry  combustible  layer  (probabilities  of 
10“^  and  10"^,  respectively).  As  with  the  sump  tank,  none  had  probabilities 
for  the  undesired  event  of  more  than  10“^  since  an  accidental  probability  of 
10-5  was  assigned  to  the  existence  of  a sufficiently  dried  TNT  layer  due 
to  the  expected  care  to  be  taken  during  welding  operations.  Table  III-VIII 
provides  a summary  of  initiation  modes  and  probabilities  of  existence  of  a 
combustible  layer. 


C . MOLECULAR  SIEVE  SYSTEM 

The  molecular  sieve  process  analyzed  in  this  study  was  the  proposed 
system  to  be  installed  for  treatment  of  tail-gap  from  the  55  ton  per  day 
nitric  acid  plant  at  Holston  Army  Ammunition  Plant.,  described  in  a letter 
from  Mr.  W.  C.  Miller  of  Union  Carbide  to  Mr.  Alfred  Tatyrek.  of  Picatinny 
Arsenal  W . Nitric  acid  plant  tail-gas  is  the  exhaust:  gas  which  emerges 
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from  the  absorption  tower  (or  scrubber)  at  the  end  of  the  nitric  acid 
manufacturing  process.  This  is  the  point  at  which  the  tail-gas  is 
received  by  the  molecular  sieve  process,  shown  in  schematic  form  in 
Figure  III -4 . 


In  the  molecular  sieve  system  considered  here,  the  tail-gas  is 
first  passed  through  a feed  chiller,  which  cools  the  gas,  condensing 
vapors,  and  then  through  a mist  eliminator,  where  condensate  is  removed 
from  the  stream.  The  gas  stream  then  goes  to  the  molecular  sieve,  where 
nitrogen  oxides  are  adsorbed  by  the  adsorbent/catalyst  before  the  ga3  is 
vented  to  the  atmosphere . 

Two  identical  catalyst/adsorbent  vessels  are  provided  so  that  one  can 
be  used  in  the  adsorbing  cycle  while  the  other  is  being  regenerated.  Part 
of  the  exhaust  gas  from  the  adsorbing  unit  is  fed  to  the  regeneration  system 
where  it  (the  gas)  goes  through  a compressor,  a steam  heater,  an  electric 
heater,  the  vessel  being  regenerated,  a recycle  gas  cooler  and  a knock- 
out drum  before  being  fed  back  into  the  absorption  tower.  During  this 
cycle,  the  adsorbent/catnlyst  is  cleaned  so  that  it  can  be  used  again  in 
the  adsorbing  cycle.  Just  before  the  regenerated  adsorbent/catalyst  vessel 
ie  placed  back  on  stream,  it  is  cooled  by  changing  the  regenerating  gaa 
stream  flow  from  the  steam  and  electric  heaters  to  a cooler  and  chiller, 
so  the  vessel  is  at  the  proper  temperature  when  it  is  returned  to  the. 
adsorbing  cycle. 


The  process  units  analyzed  in  a generalized  logic  model  of  this  sytem 
are  the  feed  chiller,  the  mist  eliminator,  the  adsorbent/catalyst  vessel, 
the  regeneration  compressor,  the  regeneration  cooler  and  gas  chiller,  the 
regeneration  gas  steam  heater,  the  regeneration  gas  electric  heater  and 
the  recycle  gas  cooler. 

The  unavailability  of  flammable  material,  makes  it  difficult  to  find 
significant  hazards  in  this  operation.  A major  upset  would  be  required  to 
produce  a combustible  mixture.  It  would  require  both  larger  quantities  of 
oxidizer  (more  NC^,  HN03,  C>2 , NH4NO3,  or  NH3)  and  a fuel  source,  such  as  a 
bearing  leaking  oil,  or  oil  left  inside  the  unit  after  maintenance. 

NH4NO3  and  NH3  are  normally  not  present  in  the  tail-gas  but  do  exist  in 
the  IINO3  process . 

For  "off-gas"  mixtures  of  nitric  acid  tail-gas,  that  contain  an 
oxidizer  (normally  very  little)  and  a fuel  from  an  external  source 
(normally  none),  impingement,  thermal,  ESD,  and  electric  power  discharge 
modes  were  examinated  for  the  "off-gas"  cloud,  while  impact,  friction, 
thermal,  ESD,  and  electrical  power  discharge  modes  were  investigated  for 
"off-gas"  deposits. 


DSC  work  with  a stoichiometric  mixture  of  nitric  acid  and  oil  in 
water  [60.6%  HN03/37.2%  H2O/2 .2%  oil]  identified  an  exothermic  isotherm 
at  265°c(14).  This  temperature  is  assumed  to  be  the  autoignition 
temperature  of  the  mixture. 
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Electrical  discharge  threshold  initiation  levels  were  reported  for  an 
HN03/oil/water  (60.6/2.2/37.2)  mixture  as  0.075J'^'  . This  was  the  same 
as  for  a mixture  of  NH4N03/HN03/oil/water  (43  ,5/33. 1//2 .5/20.5)  . When 
NH4NO3/0H  (94.5/5.5)  mixture  was  used,  0.50J^^  was  reported  as  the 
threshold  level . 

No  in-process  materials  for  the  nitric  acid  plant  were  known  to  be 
ignitable  by  impingement. 

The  threshold  impact  initiation  levels  were  more  than  61.5  ft  lb/in2 
for  anNHnNC^/oll  mixture ( *4)  f and  more  than  179K  ft  Ib/secl^)  for  either 
HN03/H20/oil  mixture  or  HNO3/H2O/NH4NO3/0H  mixture.  The  different 
dimensional  units  are  due  to  the  fact  that  the  NH4N03/oil  mixture  can 
exist  as  a solid;  whereas,  the  other  two  are  normally  liquid. 

l£he  frictional  threshold  initiation  levels  are  all  at  a velocity  of 
8 ft/sec  instead  of  at  the  in-process  velocity  of  2 ft/sec.  This  gives  a 
conservative  estimate  since  threshold  level  is  inversely  related  to  velocity. 
These  values  at  8 ft/sec  ranged  from  greater  than  54.4  kpsi  for  HNO3/ 
NH4NO3/0H/H2O  mixture (14)  to  greater  than  120  kpsi  for  NH4NO3/0H  mixture(14) 

1 . Feed  Chiller 

The  feed  chiller  normally  cools  the  tail-gas  from  the  absorption 
tower  from  38°C  (100°F)  to  about  10°C  (50°F).  This  condenses  most  of  the 
water  and  also  the  nitric  acid  formed  by  the  reaction  between  water  and 
nitrogen  dioxide.  The  tail-gas  is  usually  noncombustible;  typically 
containing  96  percent  by  weight  of  inert  nitrogen,  some  oxidizers  and  no 
fuel. 

A probability  of  10"^  was  calculated  for  the  existence  of  either 
a flammable  gas  mixture  or  a combustible  "off-gas"  deposit  since  either 
situation  would  require  at  least  two  simultaneous  accidental  events,  such 
as  an  accident  that  oil  was  present,  and  at  least  one  other  simultaneous 
accidental  failure  which  caused  sufficient  oxidizer  to  be  present.  Analysis 
of  the  logic  model  showed  there  are  two  ways  a deposit  could  exist  and  four 
ways  by  which  a flammable  cloud  could  exist.  The  computer  simulation  of  the 
generalized  logic  model  showed  50  different  minimum  sequences  of  events 
(minimum  cut  sets)  which  could  cause  the  undesired  event.  Eight  involved 
impingement  for  which  no  in-process  material  was  identified  that  could 
produce  a hazard.  Consequently,  only  42  different  sequences  were  applicable 
to  this  system.  Of  these,  none  was  equal  to  or  above  the  10"^  incident 
probability  used  as  a guideline  for  assessing  a hazard.  This,  as  previously 
stated,  was  due  to  the  low  probability  of  having  flammable  material  present. 

A summary  of  the  potential  initiation  modes  is  shown  in  Table  III-IX  with 
their  safety  margins  and  probabilities  and  with  the  maximum  calculated 
probability  for  the  existence  of  sufficient  flammable  materials. 

2 . Mist  Eliminator 

The  mist  eliminator  removes  entrained  water  and  nitric  acid  from 
the  tail-gas  by  passing  the  incoming  stream  through  condensed  liquid 

111-16 


, ; . ju.-.  t 


previously  accumulated  in  the  eliminator.  The  entrained  liquid  that  is 
not  picked  up  in  the  accumulator  is  "knocked-out"  of  the  gas  by  a fiberous 
(loosely  woven)  gas  deflector  at  the  top  of  the  eliminator. 

As  with  the  feed  chiller,  a major  upset  would  be  required  to  pro- 
duce a combustible  mixture.  A probability  of  10“10  was  the  maximum  calcu- 
lated during  analysis  of  the  logic  model  for  existence  of  either  a flammable 
gas  mixture  (two  ways  identified)  or  a combustible  "off-gas"  deposit  (four 
ways  identified)  since  either  situation  could  result  only  from  a double 
simultaneous  failure. 

Computer  simulation  of  the  generalized  logic  model  identified  50 
different  minimum  sequences  of  events  (minimum  cut-sets)  which  could  cause 
the  undesired  event . Eight  involved  impingement , for  which  no  in-process 
material  was  identified  that  could  produce  a hazard.  Of  the  remaining  42 
different  sequences,  none  has  a probability  equal  to  or  greater  than  10“^. 

A summary  of  the  potential  initiation  modes  is  shown  in  Table  I1I-X  with 
safety  margins  and  probabilities  of  the  modes  and  with  the  maximum  proba- 
bility calculated  for  the  existence  of  sufficient  flammable  material  to 
support  combustion, 

3 . Adsorbent/Catalvst  Vessel 

This  unit  is  the  principal  unit  in  molecular  sieve  operation. 

Two  ouch  units  exist  such  that  one  can  be  adsorbing  when  the  other  is 
being  regenerated.  In  the  adsorption  operation,  water,  nitric  oxide,  and 
most  of  the  nitrogen  dioxide  are  selectively  adsorbed  onto  the  adsorbent/ 
catalyst.  In  the  regeneration  operation,  water  and  nitrogen  dioxide  are 
released  from  the  adsorbent /cata lyst . Regeneration  is  accomplished  by 
heating  the  stream  to  the  adsorbent/catalyst,  and  then  (in  order  to  make 
subsequent  adsorption  operation  more  efficient)  the  regeneration  vessel 
is  cooled  before  putting  it  back  into  the  adsorption  cycle. 

a.  During  Adsoprtion  - The  adsorption  process  is  exothermic,  in 
which  the  incoming  stream  is  typically  heated  from  13  C (55  F)  to  35  C (95  F) 
The  process  streams  are  normally  not  combustible,  containing  only  oxidizers 
and  inert  nitrogen  (about  96%).  A major  upset  would  be  required  to  produce  a 
combustible  mixture.  Thus  a probability  of  10"7  was  calculated  for  the 
existence  of  a combustible  layer  (one  way  identified),  since  a double 
simultaneous  accidental  occurrence  would  be  required  for  its  existence 
(the  oxidizer  coul"  selectively  build  up  on  the  catalyst  as  the  fuel  and 
contaminating  oil  possibly  could  also).  For  a combustible  vapot , the 
maximum  probability  was  calculated  to  be  10"9  (five  ways  identified) 
since  vapors  should  be  of  a more  inert  nature  than  an  accumulated  layer. 

The  undesired  event  could  be  caused  by  67  different  minimum 
sequences  of  events  (minimum  cut-sets)  identified  by  computer  simulation 
of  the  generalized  fault  tree.  Since  a combustible  for  impingement  has 
not  been  identified  for  the  nitric  acid  process,  only  52  different 
sequences  are  applicable.  Of  these,  none  has  a probability  greater  than 
or  equal  to  10“°,  again  due  to  the  low  probability  of  sufficient  combustible 
material  existing.  A summary  of  the  potential  initiation  modes  is  shown 
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in  Table  III-XI  with  sefety  margins  and  probabilities  of  the  inodes  and 
with  the  maximum  probability  calculated  for  the  existence  of  sufficient 
flammable  materials. 

b.  Regeneration  Heating  - The  desorption  of  the  nitrogen  oxides 
and  water  from  the  adsorbent/catalyst  is  an  endothermic  process.  Heat  1b 
supplied  by  a portion  of  the  exit  from  the  other  adsorbent/catalyst  vessel 
in  which  adsorption  is  occurring.  Typically  this  stream  is  heated  from 
35°C  (95°F)  to  288°C  (550°F).  The  gas  stream  ’*»  normally  noncombustible, 
typically  containing  97  percent  inert  nitrogen,  about  3 percent  cxygen 
and  trace  of  nitrogen  dioxide. 

As  with  the  other  process  unit  discussed,  a major  upset  would 
be  required  to  produce  a combustible  mixture.  The  normal  quantity  of 
oxidizer  is  small,  and  normally  no  fuel  is  present.  A maximum  probability 
of  10"®  was  calculated  for  the  existence  of  either  a flammable  gas  mixture 
(four  ways  identified)  or  a combustible  "off-gas"  deposit  (one  way  identified), 
since  either  situation  would  require  double  simultaneous  accidental  occurrences 


Computer  simulation  of  the  generalized  fault  tree  showed  56  different 
minimum  sequences  of  events  (minimum  cut-seta)  which  could  cause  the  undesired 
event.  Twelve  involved  impingement  for  which  no  in-process  material  was 
identified  that  could  produce  an  impingement  hazard.  Consequently,  only  44 
different  sequences  were  applicable  for  this  system.  None  has  a probability 
larger  than  or  equal  to  10“6.  A summary  of  the  potential  initiation  modes 
is  shown  in  Table  III-XI  with  safety  margins  and  probabilities  of  the  modes 
and  with  the  maximum  probability  of  the  existence  of  sufficient  flammable 
material. 


c.  Regeneration  Cooling  - Regeneration  cooling  of  the  adsorbent/ 
catalyst  vessel  is  conducted  after  regeneration  heating  and  prior  to 
adsorption  in  the  adsorbent/catalyst  vessel.  The  operation  is  performed 
to  prepare  the  vessel  for  the  exothermic  adsorption  process. 


As  with  the  other  process  units,  a major  upset  would  be  re- 
quired to  produce  a combustible  mixture.  The  normal  quantity  of  oxidizer 
is  small  and  normally  no  fuel  is  present.  A maximum  probability  of  10"® 
was  calculated  for  the  existence  of  either  a flammable  gas  mixture  (5 
ways  identified)  or  combustible  "off-gas"  deposit  (2  ways  identified) 
based  on  the  same  rationale  as  that  presented  in  the  "Regeneration  Heating" 
section. 


Computer  simulation  of  the  generalized  fault  tree  showed  72 
different  minimum  cut-sets  which  could  cause  the  undesired  event..  Fifteen 
of  them  involved  impingement,  for  which  no  in-process  material  was  identi- 
fied that  could  generate  a hazard.  Therefore,  only  57  minimum  cut-sets 
are  applicable  for  this  system,  none  of  which  has  a probability  equal  to 
or  above  the  10"6  guideline.  This  is  due  to  the  low  probability  of  having 
combustible  material  present.  A summary  of  the  potential  initiation  modes 
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is  shown  in  Tables  III-XI  with  their  safety  margins  an<j  probability  and 
with  the  maximum  probability  of  the  existence  of  sufficient  flammable 
material . 


d.  When  not  operating  - no  logic  model  was  drawn  for  this 
system.  The  structure  of  the  model  would  be  similar  to  the  vessel  during 
the  adsorption  operation.  The  probability  of  existence  of  flammable 
material  would  be  less,  and  the  probability  of  an  initiation  stimulus 
during  a maintenance  operation  would  be  1.0.  Since  the  probability  of 
a flammable  material  being  present  is  less  than  10“^,  no  hazard  which 
needs  correction  is  identified,  based  on  the  10“^  guideline. 

4 . Regeneration  Compressor 

The  regeneration  compressor  provides  sufficient  pressure  to  the 
feed  to  the  regeneration  adsorbent/catalyst  vessel  such  as  to  be  able  to 
add  this  stream  to  the  knockout  drum  prior  to  its  addition  to  the  ab- 
sorption tower. 

The  regeneration  compressor  performs  the  same  function  during 
regeneration  heating  as  during  regeneration.  The  only  difference  is  that 
during  regeneration  cooling  it  receives  gas  from  near  the  end  of  the 
adsorption  operation,  whereas  during  regeneration  heating  it  receives 
gas  from  the  beginning  or  the  adsorption  operation.  Near  the  end  of  the 
adsorption  operation  the  adsorbent/catalyst  would  not  hove  as  good  ad- 
sorption characteristics  since  most  of  its  adsorption  sites  would  be 
filled  and  more  oxidizer  would  be  in  the  gas  stream.  However,  under 
normal  circumstances  no  fuel  and  little  oxidizer  (about  3 percent)  are 
present . 


During  its  operation,  the  compressor  typically  pressurizes  the 
stream  from  77.6  psig  to  110  psig  while  heating  it  from  35°C  (95°F)  to 
79°C  (175°F) „ 

In  both  the  regeneration  heating  and  the  regeneration  cooling 
operations,  a major  upset  would  be  required  to  generate  a combustible 
mixture  as  previously  discussed  in  other  process  units.  Consequently, 
a maximum  probability  of  10"^  was  placed  on  the  existence  of  either  a 
flammable  gas  mixture  (5  ways  identified)  or  a combustible  "off-gas" 
deposit  (2  ways  identified)  since  either  situation  would  require  two 
simultaneous  accidental  occurrences. 


Analysis  of  the  generalized  fault  tree  showed  77  minimum  cut- 
sets which  could  cause  the  undcsired  event  during  the  regenerating 
heating  cycle.  Ten  of  these  involved  Impingement  for  which  no  in- 
process  material  was  identified  that  could  produce  a hazard.  Cons..- 
quently,  only  62  different  sequences  are  applicable  to  this  secern. 

None  had  probabilities  greater  than  or  equal  to  the  10'^  -^ed  in  assess- 
ing a hazard.  A summary  of  the  potential  initiation  mjdes  is  presented 
in  Table  III-XU  with  safety  margins  and  probabilities  of  the  modes  and 
with  the  maximum  probability  for  the  existence  of  sufficient  flammable 
material . 
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During  the  regeneration  cooling  cycle,  computer  simulation  of  the 
generalized  fault  tree  showed  70  minimum  cut -sets  which  could  cause  the 
undesired  event.  The  difference  between  the  heating  and  cooling  cycles  is 
in  the  ESD  initiation  mode.  ESD  potential  from  airveying  the  "off-gas" 
and  the  adsorbent/catalyst  were  considered  neparately  in  the  heating  cycle 
hut  combined  for  the  cooling  cycle.  In  the  regeneration  cooling  eye  60 
different  minimum  cut -sets  were  considered  applicable  (impingement  ws.. 
eliminated  from  consideration  a*  a source)  to  the  plant.  None  present  a 
probability  of  occui.ce.nce  greater  than  or  equal  to  10“^>  due  to  low  proba- 
bility of  having  combustible  material  present.  A summary  of  potential 
initiation  modes  is  given  in  Table  III -XII  with  safety  margins  and  proba- 
bilities of  the  modes  and  with  the  maximum  probability  of  existence  of 
sufficient  flammable  material  to  cause  an  incident. 

As  with  the  adsorbent/catalyst  vessels,  no  logic  model  was  drawn 
for  the  compressor  when  not  operating.  Tne  structure  would  be  similar  to 
the  compressor  during  either  regeneration  cooling  or  regeneration  heating. 

The  existence  of  flammable  material  would  have  a lower  probability  although 
the  probability  of  an  initiation  stimulus  during  a maintenance  operation 
would  be  1.0.  Since  the  probability  of  a flammable  material  being  present 
is  less  than  10“10,  no  hazard  which  requires  corrective  action  was  identified. 

5 . Regeneration  Gas  Steam  Heater 

The  regeneration  gas  steam  heater  is  connected  directly  to  the 
outlet  of  the  compressor.  Steam  is  used  to  heat  the  compressed  gas  for  the 
regeneration  heating  operation.  The  gas  is  typically  heated  from  79°C 
(175°F)  to  about  182 °C  (360°F). 

As  in  the  other  process  units,  a major  upset  would  be  required  to 
generate  combustible  material.  Consequently , a maximum  probability  of 
10“10  was  assigned  to  its  existence  (2  ways  identified  for  a layer  and  4 
for  a cloud)  as  for  tlv  other  process  units. 

Analyses  of  the  generalized  fault  tree  showed  56  different 
minimum  sequences  of  events  which  could  cause  the  undesireu  event . Eight 
involved  impingement,  for  A/hich  no  in-process  material  was  identified  that 
could  produce  a hazard.  Consequently,  only  48  are  applicable  to  this 
system,  and  none  had  a probability  equal  to  or  above  the  10-^  incident 
probability  criteria.  A summary  of  the  potential  initiation  modes  is 
shown  in  Table  III-XIII  with  safety  margins  and  probabilities  of  the  nodes 
and  with  the  maximum  probability  for  the  existence  of  sufficient  flammable 
material  to  support  combustion. 

6 . Regeneration  Gas  Electric  Heater 

The  regeneration  gas,  as  it  leaves  the  steam  heater,  is  further 
heated  in  the  electric  heater  to  288cC  (550°F). 


A major  upset  would  be  required  to  generate  combustible  material. 
Thus  a maximum  probability  of  10_10  was  assigned  to  its  existence  (2  ways 
identified  for  a layer  and  4 ways  for  a cloud). 
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Sixty  eight  minimum  cut -sets  were  found  in  the  analysis  of  the 
generalized  logic  model  which  could  cause  the  undesired  event.  Eight 
involved  impingement  which  is  not  applicable  to  this  plant.  Consequently, 
60  cue-sets  apply  to  this  system.  None,  however,  had  a probability  of 
occurrence  greater  than  or  equal  to  10'®.  A summary  of  the  potential 
initiation  modes  is  given  in  Table  ‘1II-XIV  with  safety  margins  and 
probabilities  of  the  modes  and  with  the  maximum  probability  for  the 
existence  of  flammable  material. 

7 . Regeneration  Cooler  and  Gas  Chiller 

The  regeneration  cooler  and  gas  chiller  are  connected  in  series 
to  the  compressor  discharge  and  are  activated  during  regeneration  ceding. 
They  cool  the  discharge,  from  79°C  (175°F)  to  66°C  (150°F)  . 

As  with  the  other  process  units,  a major  process  upset  would  be 
required  to  generate  a flammable  material;  consequently,  a maximum  proba- 
bility of  10"*®  was  calculated  for  its  existence,  (1  way  identified  for  a 
layer  and  5 ways  for  a cloud). 

Sixty  five  minimum  cut-sets  were  shown  in  the  computer  simulation 
of  the  generalized  logic  model,  ten  of  which  pertain  to  an  impingement 
initiation.  Since  no  in-process  material  was  identified  that  could  pro- 
duce an  impingement  initiation  hazard,  only  55  apply  to  the  nitric  acid 
facility.  None,  however,  had  probabilities  for  the  undesired  event  equal 
to  or  greater  than  lCT^.  A summary  of  the  potential  initiation  modes  is 
shown  in  Tables  HI -XV  and  XVI  with  safety  margins  and  probabilities  of 
the  modes  and  with  the  maximum  probability  for  the  existence  of  sufficient 
flammable  material. 


8 » Recycle  Gas  Cooler 

The  recycle  gas  cooler  cools  the  gas  from  the  adsorbent/catalyst 
vessel  during  regeneration  before  it  combines  with  the  nitric  acid  stream 
entering  the  knockout  drum.  During  regeneration  heating,  this  stream  is 
cooled  to  260°C  (500°F)  and  it  is  cooled  to  21°C  (70°F)  during  regeneration 
cooling . 

As  with  other  units  in  this  process,  simultaneous  major  upsets 
would  be  required  to  permit  flammable  material  to  exist.  A probability 
of  10"*®  is  calculated  for  a flammable  cloud  (1  way  identified)  and  10"*^ 
for  a layer  of  "off-gas"  (5  ways  identified). 

Analysis  of  the  generalized  logic  model  shewed  49  minimum  cut- 
sets which  could  cause  the  undesired  event.  Thirty  nine  of  these  were 
applicable  to  the  nitric  acid  system  since  ten  pertained  to  impingement, 
for  which  no  ln-process  material  was  known  to  be  ignitible.  None  had 
probabilities  equal  to  or  greater  than  10"^  for  the  undesired  event.  A 
summary  of  the  potential  initiation  modes  is  showr  in  Table  III -XVII 
with  safety  margins  and  probabilities  of  existence  of  the  modes  and  of 
the  maximum  probability  for  the  existence  of  sufficient  flammable 
material  to  support  combustion. 
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D,  FLUIDIZED  BED  INCINERATION  Of  EXPLOSIVES  AND  PROPELLANTS 

The  basis  for  the  fluidized  bed  system  was  provided  by  specifications^-*) 
for  changing  the  vertical  incinerator  at  Ficatinny  Arsenal  to  a fluidized  bed. 
This  system  was  based  on  research  at  Esso  Research  and  Engineering  Company 
and  assumed  that  the  proepllan'c/explosive  feed  slurry  is  available  at  the 
bed,  so  preparation  of  the  slurry  is  not  included  in  this  analysis.  The 
incinerator  is  depicted  in  Figure  Hi- 5. 

Several  process  units  were  considered  in  this  study.  The  air  intake 
filter  mufflers,  air  blower  (compressor),  and  discharge  muffler  normally 
deliver  particle-free  air  to  the  burner  and  the  bed.  The  burner  serves  as 
the  ignition  chamber  for  fuel  oil,  which  subsequently  burns  in  the  pre- 
heater before  entering  the  plenum  for  further  combustion.  Hot  burning 
gases  flow  into  the  bed  chamber  through  a grid  which  separates  the  bed 
from  the  plenum.  The  hot  gases  fluidize  the  bed  material  (alumina  base), 
slurried  propellant  or  explosive,  and  auxiliary  fuel  oil,  if  necessary. 

The  combustion  products  are  carried,  as  a gas  particulate  stream,  into  a 
cyclone  separator,  from  which  normally  particle-free  gas  flows  into  the 
stack. 

The  process  is  carefully  controlled  by  a "Flame  Guard"  in  the  pre- 
heater, and  an  operational  control  center.  The  operational  control  center 
contains  interlocks  for  sequential  and  alarm  conditions  and  blocks  certain 
circuits  until  proper  operating  conditions  have  been  met. 

Four  fuel  sources  were  considered  for  the  undesired  event  of  "fire  or 
explosion  results  in  personnel  death  or  injury  or  equipment  damage." 

Natural  gas  exists  as  a pilot  gas  at  the  burner.  Fuel  oil  provides  fuel 
for  the  burner  as  well  as  auxiliary  fuel  to  the  bed.  Propellant  or 
explosive  enters  in  the  slurry  feed  to  the  bed  or  possibly  as  a polluting 
dust  from  the  air  intake  filter  muffler.  Unburned  propellant  or  explosive, 
or  a layer  of  unburned  combustible  byproducts  of  propellant  or  explosive 
material  was  the  third  source.  The  fourth  fuel  was  a cloud  of  unburned 
propellant  or  explosive  material  or  a cloud  of  combustible  byproducts  of 
propellant  or  explosive. 

Three  propellant  and  explosive  materials  are  presented  as  typical 
materials.  They  are  Ml  propellant  (*■■*)  , TNT'  * ',  and  N5  propellant^'). 

The  probabilities  shown  in  the  summarizing  tables  represent  the  worst 
situation;  e.g.,  the  lowest  safety  margin  of  the  three  materials  was  used 
in  determining  the  probabilities  of  initiation.  If  one  material  caused  a 
hazard  and  another  did  not,  as  defined  by  the  10“^  incident  probability, 
it  was  so  noted. 


Two  sets  of  initiation  modes  were  defined  for  propellant  or  explosive 
materials,  one  for  a dust  cloud  and  the  other  for  a dust  layer.  Impinge- 
ment, thermal,  ESD,  and  electrical  power  discharge  modes  were  analyzed  as 
potential  initiation  modes  for  the  combustible. 
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For  minimum  impact  energy,  threshold  initiation  on  stainless  Bteel 
was  used.  Initiation  levels  ranged  from  3.8  ft-lb/in2  for  Ml  propellant'1  ' 
to  31.6  ft-lb/in2  for  TNT<12.13). 

Frictional  initiation  material  response  values  (TILs)  at  2 ft/sec 
velocity  were  used.  The  values  were  34  kpsi  for  N5  propellant^1?) , 190 
kpsi  for  TNT'12  »13)  and  120  kpsi  for  Ml  propellant. 

Thermal  initiation  levels  w'ire  constant  for  TNT  and  N5  propellant,  at 
230°C'12*1^)  and  150°G^1?)  respectively.  The  autoignition  temperature  of 
Ml  propellant  was  strongly  time  dependent.  After  24  hours  at  120°C,  Ml  will 
reportedly  ignite'1®).  This  was  used  as  the  autoignition  temperature  for  a 
layer  of  Ml  propellant.  However,  Ml  will  reportedly  ignite  at  150°C  after 
only  one  hour;  this  was  used  as  the  autoignition  temperature  for  a dust 
cloud. 


Similar  variation  existed  for  electrical  ignition,  both  from  ESD  and 
electrical  power  discharge.  Both  TNT  and  N5,  in  either  cloud  or  layer, 
were  reportedly  ignited  by  0 .075J'12 » ^ >1?) , However,  Ml  required  only 
O.OISJ'1^)  to  ignite  as  a layer  but  0.024J^^)  to  ignite  as  a dust  cloud. 


The  impingement  initiation  threshold  levels  for  these  materials  varied 
from  greater  than  10,000ft/min  for  a layer  of  Ml  dust^1^)  to  38,000  ft/min 
for  TNT<12»13) . 


For  natural  gas  and  fuel  oil,  thermal,  ESD,  and  electrical  power 
discharge  initiation  modes  were  evaluated.  Natural  gas  has  an  ignition 
temperature  of  about  210°C^1®)  and  a electrical  ignition  threshold  of 
0.002J'19) . Fuel  oil  is  harder  to  ignite  thermally,  with  an  ignition 
temperature  of  482 “C'1®)  but  is  much  easier  to  ignite  electrically, 
requiring  only  0,47  mj^19). 


1.  Air  Intake  Filter  Muffler 


All  air  supplied  to  the  fluidized  bed  enters  the  process  through 
the  air  intake  filter  muffler.  At  the  time  of  the  analysis,  the  specifi- 
cations of  the  intake  muffler  were  not  known  to  Picatinny  Arsenal.  Conse- 
quently, the  assumption  was  made  that  the  filter  material  was  of  the  fibrous 
cloth  type,  which  is  combustible  and  capable  of  generating  an  electrostatic 
charge . 


Initiation  of  the  filter  material  was  considered  very  unlikely. 

The  presence  of  fuel  oil  and  pilot  gas  in  the  air  intake  muffler 
were  not  considered,  due  to  the  barrier  created  to  a path  from  the  burner 
to  the  intake  muffler  by  the  air  blower  when  the  bln>.  ^r  is  not  operating. 
When  it  is  operating,  air  from  the  blower  transports  these  fuels  further 
away  from  the  muffler. 

Two  other  fuel  sources  whose  presence  was  considered  remote  were 
analyzed  in  detail.  The  fuel  sources  were  the  previously  discussed 
combustible  (propellant  or  explosive  material  or  byproducts)  layer  and 
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cloud.  Analysis  Identified  60  minimum  sequences  of  events  which  might 
cause  the  undesired  event  of  "fire  or  explosion  results  in  equipment 
damage  or  personnel  injury  or  death."  Thirty -three  applied  to  a com- 
bustible layer  and  27  to  a cloud.  Three  independent  sequences  were 
described  in  the  logic  model  by  which  either  a cloud  or  layer  could 
develop  in  the  intake  filter.  The  maximum  probabilities  were  10“®  for 
the  existence  of  a layer  and  10"13  for  a cloud.  Since  both  probabilities 
are  less  than  10“^,  no  unacceptable  hazard  was  identified. 

Summaries  of  the  initiation  modes  for  the  intake  filter  are 
shown  in  Table  III-XVIII.  These  describe  safety  margins  and  probabilities 
calculated  for  the  initiation  modes  as  well  as  the  maximum  calculated 
probability  for  existence  of  the  fuels, 

2 . Air  Blower 


A constant  displacement  type  blower  supplies  air  for  combustion, 
fluidization,  and  flue  gas  quality  control.  It  is  started  manually.  A 
time  delay  relay  (TDR-1)  on  the  manual  start-stop  switch  controls  a 
solenoid  valve  (SV-102)  on  the  outlet  of  pressure  controller  PC-1  to 
allow  butterfly  valve  BV-101  to  remain  open,  venting  the  blower  to 
atmosphere  during  starting,  to  prevent  pressure  buildup  in  the  preheater. 

At  expiration  of  the  planned  delay  time,  relay  TDR-1  operates, 
causing  valve  SV-102  to  open,  allowing  pressure  controller  PC-1  to 
modulate  valve  BV-101  in  order  to  maiutain  a pressure  of  about  6.2  pBig 
in  the  air  supply  line. 


All  four  sources  identified  as  fuels  for  the  undesired  event  in 
the  fluidized  bed  system  were  considered  for  the  air  blower  even  though 
their  probabilities  are  low.  Analysis  identified  129  minimum  cut-sets 
for  the  undesired  event.  Thirty-six  are  from  three  independent  sequences 
identified  by  the  logic  model  for  producing  a combustible  layer,  30  are 
from  three  sequences  chat  generate  fuel  oil,  and  28  are  from  four  sequences 
that  provide  natural  gas.  The  maximum  probabilities  calculated  for  the 
existence  of  sufficient  fuel  were  10”^  for  a layer,  10“^^  for  a cloud, 

10”12  for  oil,  and  10 for  natural  gas.  Since  all  probabilities  of  the 
presence  of  fuel  for  the  undesired  event,  and  thus  for  initiation  were 
below  the  incident  probability  of  10"^,  no  unacceptable  hazard  was  found 
for  the  air  blower. 


Summaries  of  the  initiation  modes  for  the  air  blower  are  shown  in 
Table  III -XIX,  describing  the  safety  margins  and  probabilities  calculated 
for  these  initiation  modes  as  well  as  the  maximum  calculated  probability 
for  existence  of  fuels. 


3 . Discharge  Muffler 

The  discharge  muffler  decreases  the  noise  level  of  an  auxiliary 
stream  from  the  air  blower  to  an  acceptable  level  . This  side  stream  also 
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helps  control  the  air  supplied  to  the  fluidized  bed. 

Since  the  discharge  muffler  is  downstream  of  the  air  blower,  a 
path  exists  for  fuel  oil  or  pilot  gas  to  migrate  to  the  discharge  muffler 
when  the  air  blower  is  not  operating.  Thus,  fuel  oil  and  pilot  gas  can 
be  considered  along  with  the  combustible  layer  and  cloud  as  potential 
fuel  sources. 


Ninety  minimum  cut-sets  were  identified  by  analysis  of  the  logic 
model  for  the  discharge  muffler.  Thirty  resulted  from  layer  initiation 
with  the  maximum  probability  for  three  different  sequences  for  the 
existence  of  the  layer  being  10“^.  Twenty-four  developed  from  cloud 
initiation  with  10"  *3  being  the  maximum  probability  for  three  different 
sequences  by  which  the  cloud  could  exist.  The  maximum  probability  for 
the  existence  of  flammable  fuel  oil  or  pilot  gas  was  lO"*  . Five 
different  sequences  for  existence  of  fuel  oil  resulted  in  25  minimum 
cut -sets  for  the  undesired  event,  while  four  different  sequences  for  the 
existence  of  pilot  gas  resulted  in  20  minimum  cut-sets  for  the  undesired 
event.  Consequently,  no  unacceptable  hazard  was  identified  for  the 
discharge  muffler  since  all  probabilities  for  sufficient  fuel  for  the 
undesired  event  were  below  the  10"6  incident  probability. 

Initiation  modes  for  the  discharge  muffler  are  summarized,  with 
their  safety  margins  and  probabilities,  in  Table  III-XX,  The  maximum 
calculated  probability  for  the  existence  of  fuel  is  also  presented  there. 


4.  Burner 
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The  burner  is  the  primary  initiation  chamber  for  fuel  oil  supplied 
to  the  grid. 

Startup  of  the  burner  is  critical  to  operation  of  the  system. 

Blower  air  must  be  available  at  some  minimum  flow  rate  through  the  com- 
bustible air  controller  (FC-2)  and  the  control  valve  (V-105).  The  start 
button  (FB-1)  is  then  pressed  and  held  to  activate  the  Flame  Guard,  the 
pilot  gas  solenoid  valve  control,  and  the  electrical  igniter  for  the  pilot 
gas.  (Details  of  the  ipution  system  were  not  available  so  the  analysis  is 
general. ) 

At  the  command  of  the  burner  control  (FC-2),  the  solenoid  valve 
SV-203  opens  to  introduce  oil  to  the  proportioning  control  valve.  An 
internal  bypass  (V-204)  is  set  to  a minimum  ignition  flow  if  high  pressure 
atomizing  air  is  available  at  the  pressure  switch  (PS-6)  and  the  temperature 
controller  (TC-1)  is  set  to  an  internal  low  temperature  limit. 

The  Flame  Guard  takes  over  as  soon  as  the  Flame  Guard  Eye  senses 
a proper  oil  flame  at  the  burner,  and  the  start  push  button  may  be  released. 
If  the  flame  is  not  recognized  within,  a set  time,  SV-2  03  is  de-energized, 
and  the  oil  supply  is  shut  off.  SV-203  is  also  closed  instantly  if  the 
Flame  Guard  Eye  senses  a blow-out  or  no  flame  and  manual  restart  must  then 
be  initiated. 
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Four  fuel  sources  were  considered  in  the  logic  model . They 
were  the  previously  discussed  combustible  layer,  cloud,  pilot  gas,  and 
fuel  oil.  Existence  of  the  first  two  is  unlikely,  whereas  the  latter  two 
are  present  during  normal  operations. 

One  hundred  fifty-nine  different  sequences  of  events  were 
identified  by  analysis  of  the  logic  model  leading  to  the  undesired  event. 
Forty-two  resulted  from  three  independent  sequences  by  which  the  com- 
bustible layer  could  be  present . Three  independent  sequences  by  which 
the  combustible  cloud  could  exist  in  the  burner  resulted  in  36  minimum 
cut-sets  for  the  undesired  event.  The  maximum  probability  for  the 
existence  of  either  a combustible  layer  or  a combustible  cloud  was  10”13, 
Thus,  78  minimum  cut-sets  for  the  undesired  event  for  these  combustible 
materials  were  identified  as  acceptable  hazards.  Five  independent  sequences 
by  which  sufficient  fuel  oil  can  exist  and  four  for  sufficient  pilot  gas 
produced  respectively,  46  and  36  minimum  cut-sets  for  the  undesired  event. 
The  maximum  probability  for  sufficient  flammable  fuel  oil  or  pilot  gas  to 
exist  in  the  burner  is  calculated  as  10“^.  This  would  occur  when  a system 
failure  in  the  pilot  gas  feed  line  transports  sufficient  pilot  gas  to  the 
burner.  (Insufficient  detail  on  this  phase  of  the  system  necessitates 
this  assumption.)  This  gas  might  extinguish  or  partially  extinguish  the 
flame  and  subsequently  reignite,  causing  a hazard.  Design  of  the  pilot 
gas  line  to  limit  pilot  gas  flow  can  prevent  this  problem,  if  it  exists. 

A similar  situation  could  exist  for  fuel  oil.  By  neglecting  these  modes, 
no  sequences  of  events  were  observed  for  the  existence  of  fuel  oil  or 
pilot  gas  with  a probability  of  more  than  10"®,  due  to  the  control  system. 

Three  sources  of  initiation  were  identified  for  both  fuel  oil  and 
pilot  gas.  Thermal  sources  wore  the  only  initiation  modes  that  could  cause 
an  unacceptable  hazard  (probability  greater  than  or  equal  to  10-®)  for  the 
previously  discussed  10-^  probability  of  fuel  being  present.  They  include 
normally  occurring  burner  fire,  normally  occurring  fire  in  the  preheater, 
and  residual  heat  from  extinguished  fire.  Adequate  design  to  limit  pilot 
gas  and  fuel  oil  flows,  as  previously  stated,  would  eliminate  these  hazards. 

Summaries  of  the  various  initiation  modes  with  their  probabilities 
and  safety  margins  are  presented,  with  the  maximum  calculated  probability 
of  existence  of  sufficient  fuels,  in  Table  I II -XXI. 

5 . Preheater 

Fuel  oil  that  is  ignited  in  the  burner  is  transported  by  the  air 
stream  into  the  preheater.  This  preheater  is  a large  chamber  into  which 
the  burner  opens.  The  previously  mentioned  Flame  Guard  is  actually 
located  in  the  preheater. 


Fuel  sources  considered  were  the  same  four  as  for  the  burner. 

One  hundred  seventy-four  minimum  cut-sets  which  could  produce  the 
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undesired  event  were  identified  by  computer  simulation  of  the  logic  model. 

Forty-five  and  thirty-nine  resulted  from  three  sequences  for 
generating  the  combustible  layer  and  the  combustible  cloud,  respectively. 
Both  had  a maximum  probability  for  the  existence  of  the  cloud  or  layer  of 
10“J3  and  were  thus  considered  acceptable  hazards.  Ten  independent 
initiation  modes  were  applicable  to  five  sequences  which  might  produce 
sufficient  flammable  fuel  oil  and  to  four  sequences  which  might  produce 
sufficient  flammable  pilot  gas.  Both  had  a probability  of  10"®  that 
sufficient  flammable  material  would  be  present.  Thus,  neither  resulted 
in  an  unacceptable  hazard,  since  probability  of  the  undesired  event  was 
less  than  10"® . 

Summaries  of  the  initiation  modes  for  the.  preheater  are  shown  in 
Table  1X1 -XXII.  These  describe  the  safety  margins  and  probabilities 
calculated  for  these  initiation  modes  as  veil  as  the  maximum  calculated 
probability  for  existence  of  the  fuels. 

6 . Plenum 


The  same  four  fuels  were  considered  for  the  undesired  event  in 
the  plenum  as  in  the  preheater. 

Two  hundred  and  five  minimum  cut  sets  that  could  produce  the 
undesired  event  ware  identified  by  computer  simulation  of  the  logic  model. 
Sixty-five  resulted  from  a combustible  layer,  60  from  a combustible  cloud, 
48  from  fuel  oil,  and  32  from  pilot  gas.  None  were  unacceptable  hazards 
due  to  the  low  probability  of  having  sufficient  material.  Five  sequences 
for  a combustible  layer  and  five  for  a combustible  cloud  had  maximum 
probability  of  10"®.  Six  fuel  oil  sequences  had  a maximum  probability  of 
10"1®  as  did  the  four  pilot  gas  sequences. 

The  initiation  modes  for  the  plenum  are  summarized  with  their 
safety  margins  and  probabilities  in  Table  III-XXIII.  Also  included  in 
these  tables  are  the  maximum  probability  for  the  existence  of  sufficient 
combustible  materials. 

7.  Grid 

The  grid  serves  two  principal  purposes.  It  helps  distribute  the 
gas  flow  uniformly  throughout  the  bottom  of  the  bed,  and  also  separates 
the  fluidized  bed  from  the  plenum. 

Analysis  of  the  logic  model  showed  185  minimum  cut -sets  that  could 
cause  the  undesired  event.  None,  however,  generated  an  unacceptable  hazard 
due  to  the  low  probabilities  calculated  for  sufficient  fuel  existing.  Five 
sequences  for  creating  a combustible  layer  caused  60  minimum  cut-sets  for 
producing  the  undesired  event;  however,  the  maximum  probability  for  the 
existence  of  sufficient  combustible  was  only  10"®.  The  same  situation 
existed  for  the  flammable  cloud  except  only  55  minimum  cut-sets  were 


III -28 


-‘‘HiiMiTi  ,,t  I Tir 


- ;t  'f;  7,7 


TV,  ■<  • .;-.w  r^.-i>f  V^VVI^'T' -IT'v'W  *"‘ffi' v-  ' ■,  \‘tV*-rr-  y.K.VT 


o 


identified  which  could  cause  the  undesired  event.  Six  minimum  sequences 
for  accumulating  sufficient  fuel  oil  were  given  in  the  logic  model  to 
develop  42  minimum  cut -sets  for  the  undesired  event;  the  probability  of 
sufficient  fuel  oil  existing  was  only  10"16,  For  natural  gas,  only  four 
sequences  were  identified  to  accumulate  a sufficient  quantity  in  the  grid. 
This  generated  28  minimum  cut-sets  for  the  undesired  event,  although  none 
resulted  in  an  unacceptable  hazard,  due  to  the  maximum  probability  of 
10-20  for  existence  of  sufficient  flammable  fuel  oil. 

A summary  of  the  initiation  modes  with  their  safetv  margins  and 
probabilities,  and  the  maximum  calculated  probability  for  the  existence 
of  sufficient  combustible  materials  is  shown  in  Table  II1-XXIV, 

8.  Bed 

Combustion  of  the  slurried  propellant  or  explosive  is  the  primary 
operation  performed  in  the  fluidized  bed.  Other  operations  such  as  adding 
makeup  bed  material  are  also  considered. 

Most  feeding  operations  are  semi-automatic  and  have  control  inter- 
locks. One  example  is  the  in -bed  oil  feeding  operation.  As  the  fluidized 
bed  temperature  is  raised  to  the  fuel  oil  autoignition  temperature  during 
startup,  the  oil  low  bed  temperature  control  (TC-3)  will  indicate  by 
glowing  lights  that  the  in-bed  injection  oil  circuit  may  be  activated. 
Activation  before  this  point  is  prevented  by  an  interlock  in  the  flow 
control  center  (PC-3)  and  the  safety  and  operational  control  panel  (CP-i) . 
However,  the  possibility  of  an  erroneous  (too  high)  reading  from  TC-3  could 
override  the  interlock.  Consequently,  careful  check  must  be  made  by  the 
operator  before  activating  the  in-bed  injection  oil  circuit, 

By  activation  of  an  acknowledgment  button  on  the  safety  control 
panel  (CF-1) , one  or  more  pairs  of  oil  injection  nozzles  (SV-209  to  SV-214) 
may  be  opened  to  a minimum  flow  at  the  command  of  a flow  control  in  the 
in-bed  oil  flow  control  center.  The  number  of  oil  injection  nozzle  pairs 
is  completely  at  the  discretion  of  the  operator.  They  may  be  activated  or 
deactivated  through  the  in-bed  oil  flow  control  center.  This  will  block 
the  temperature  controller  (TC-4)  output  to  in-bed  oil  flow  control  center 
(PC -3)  in  the  event  that  the  oil  low  bed  temperature  limit  control  (TC-3) 
falls  below  the  minimum  ignition  temperature  of  the  oil. 

The  flow,  as  set  by  (PC -3),  is  increased  gradually  to  obtain  a 
predetermined  temperature,  at  which  time  a low  temperature  control  (TC-5) 
will  indicate  to  the  slurry  control  center  (PC-4)  that  the  slurry  valves 
can  be  opened  or  activated. 

Before  the  slurry  can  be  injected  into  the  bed,  the  operational 
control  center  (CP-1)  requires  that  the  blower  is  started,  the  preheater 
burner  is  igniting  the  fuel  oil,  and  the  in-bed  injection  system  activated. 
In  addition,  it  assures  that  the  ail  pressure  switch  (PS-5)  on  the  oil  to 
control  valves  (V-206,  V-207,  V-208)  is  activated  and  a minimum  fluid  bed 
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temperature  of  1300°F  to  1650°F  is  sensed  by  the  slurry  low  temperature 
control  (TC-5) . 

The  slurry  injection  nozzles  are  all  supplied  by  one  control 
valve  (PC -301)  during  normal  operation  but  may  be  individually  shut  off 
and  purged  remotely  by  a remote  nozzle  purge  selector  switch  center. 

When  the  minimum  fluid  temperature  is  reached,  TC-5  plus  PS-5  in  the  oil 
injection  line  and  PS-1  in  the  purge  water  line  allow  the  slurry  injection 
valve  (PV-301)  to  be  operated. 

During  normal  shutdown  procedures,  the  slurry  control  center 
stop  button  (PB-3)  is  pressed,  deactivating  the  slurry  supply  valves  and 
activating  the  slurry  nozzle  flush  cycle.  The  emergency  back-flush  should 
be  followed  shortly  thereafter. 

The  primary  function  of  control  panel  (CP-1)  is  to  prevent  any 
slurry  from  being  injected  into  the  fluid  bed  before  proper  ignition 
conditions  are  obtained,  and  to  prevent  slurry  from  remaining  in  the 
header  lines  after  system  shutdown  due  to  an  alarm  condition. 

Four  situations  constitute  an  alarm  condition.  They  ure  (1)  loss 
of  main  injection  oil  pressure,  (2)  lowering  the  fluid  bed  temperature 
below  the  predetermined  combustion  temperature  of  the  slurry,  (3)  an 
excessively  high  temperature  either  above  the  bed  or  at  the  entrance  to 
the  cyclone  '.operator , and  (4)  loss  of  fluidizing  air  pressure  either  by 
loss  of  electrical  power  for  the  blower,  or  malfunction  of  the  butterfly 
valve  feeding  air  through  the  preheater  to  the  plenum  chamber. 


The  in-bed  oil  flow  center  is  under  the  control  of  the  operational 
control  center  and  can  have  its  total  oil  shut  off  (and  be  deactivated)  by 
(1)  decreased  fluidization  (minimum  under  grid  plenum  pressure),  (2)  re- 
duced cooling  water  pressure,  or  (3)  minimum  alarm  temperature  in  the  top 
of  the  incinerator  tower  (TI-7)  . 


The  same  fuel  sources  were  considered  in  the  logic  model  for  the 
bed  that  were  considered  for  the  grid. 

Computer  simulation  of  the  logic  model  showed  202  minimum 
sequences  of  events  which  could  generate  the  undesired  event. 

However,  due  to  the  low  probability  of  having  sufficient  flammable 
present,  no  unacceptable  hazards  were  identified.  Five  independent  ways 
by  which  a sufficient  combustible  layer  could  exist  and  five  for  the 
combustible  cloud  each  had  a maximum  probability  of  10“®.  Five  sequences 
by  which  sufficient  flammable  fuel  oil  could  exist  had  a maximum  proba- 
bility of  10“^,  while  four  for  pilot  gas  had  a 10~24  probability  that 
sufficient  flammable  gas  is  present.  Of  the  202  minimum  sequences  previously 
mentioned,  70  resulted  from  a layer  being  initiated,  60  from  a cloud  being 
initiated,  40  from  fuel  oil  being  initiated,  and  32  from  pilot  gas  being 
initiated . 
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Summaries  of  the  initiation  modes  for  the  bed  are  shown  in 
Tables  II I -XXV . These  describe  the  safety  margins  and  prooabilities 
calculated  for  these  initiation  modes  as  well  as  the  maximum  calculated 
probability  for  existence  of  the  fuels. 

9 . Cyclone  Separator 

The  cyclone  separator  romoves  particulate  matter  from  the  bed 
effluent  gas  by  using  centrifugal  force  to  amplify  the  settling  rate  of 
the  particles.  It  consists  of  a vertical  cylinder  with  a conical  bottom, 
a tangential  inlet  near  the  top  and  an  outlet  for  dust  at  the  bottom  of 
the  cone. 


Two  fuels  were  considered  in  the  logic  model.  They  were  a 
combustible  layer  and  a combustible  cloud. 

Computer  simulation  of  the  logic  model  identified  110  different 
sequences  by  which  the  undesired  event  could  develop.  Sixty  resulted 
from  five  different  sequences  by  which  a combustible  layer  could  exist. 

A maximum  probability  of  10“®  was  calculated  for  the  presence  of  a com- 
bustible  layer.  Ten  different  initiation  modes  resulted  in  50  sequences 
by  which  the  undesired  event  could  be  caused  from  five  independent 
sequences  for  a combustible  cloud.  The  maximum  probability  was  also 
1Q“®  for  the  existence  of  a combustible  cloud. 

Summaries  of  the  initiation  modes  with  safety  margins  and 
probabilities  are  shown  in  Table  III -XXVI,  along  with  the  maximum  proba- 
bility for  existence  of  sufficient  fuel. 

10.  Stack 


The  stack  in  a large  chimney  into  which  the  exhaust  gases  from 
the  cyclone  separator  are  transported. 

The  same  two  fuel  sources,  a combustible  layer  and  a combustible 
cloud,  considered  in  the  cyclone  separator  are  applicable  to  the  stack. 

Computer  simulation  of  the  logic  model  identified  110  independent 
sequences  by  which  the  undesired  event  could  occur.  However,  due  to  the 
maximum  calculated  probability  of  10“8  that  a combustible  layer  or  a com- 
bustible cloud  could  be  present,  no  unacceptable  hazards  were  identified. 
Five  sequences  by  which  the  combustible  layer  could  occur  accounted  for 
60  of  the  110  independent  sequences  for  the  undesired  event,  while  five 
sequences  for  the  combustible  cloud  accounted  for  the  other  50. 

Summaries  of  the  initiation  modes  with  their  safety  margins  and 
probabilities  are  shown  in  Table  III -XXVII,  along  with  the  maximum 
probabilities  for  the  existence  of  fuel. 


Ill -31 


l.  jMiiiawwHWMUjiii'py  w .'iw"1.  w»j»')wi8uii.'.'if'iii!i<wiwii.i  ..wg"  -y/iww^wawCT! 


D . INCINERATION  OF  CONTAMINATED  INERT  WASTE 


The  basis  for  the  analysis  was  the  prototype  contaminated  waste 
incinerator  described  in  a final  report  by  Uniroyal,  Inc. (5)  and 
located  at  Joilet  Army  Ammunition  Plant  (JAAP).  It  consists  of  four 
basic  process  units:  (1)  a hopper,  (2)  a dual  action  ram  charger,  (3)  a 

dual  chamber  furnace  and  (4)  a stack.  A sketch  of  the  system  appears  on 
Figure  III-6.  Shredded  cardboard  and  paper  that  previously  contained 
explosive  or  propellant  materials  are  visually  inspected  prior  to 
addition  to  the  hopper  and  subsequent  combustion  in  the  furnace. 


Three  fuel  sources  were  considered  for  the  undesired  event  - "fire 
or  explosion  results  in  equipment  damage  or  personnel  death  or  injury." 
The  most  plausible  was  propellant  or  explosive  material.  It  could  be 
present  in  sufficient  quantity  as  a cloud  or  a layer  if  the  operator 
did  not  check  materials  in  process  and  remove  undesired  material.  Three 
examples  of  possible  contaminants  were  selected  as  being  typical:  Ml, 

TNT,  and  N5.  Other  potential  fuel  sources  were  natural  gas  and  fuel  oil. 
Natural  gas  is  used  in  the  existing  furnace  although  fuel  oil  might  be 
used  in  some  future  design  or  possibly  in  a modification  to  the  existing 
furnace . 


As  in  the  fluidized  bed,  two  sets  of  initiation  modes  were  defined 
for  propellant  or  explosive  materials,  one  for  a dust  cloud  and  another 
for  a dust  layer.  Impingement,  thermal,  ESD,  and  electrical  power  dis- 
charge modes  were  evaluated  ns  potential  initiation  modes  for  a cloud  of 
combustible.  Impact,  friction,  thermal,  ESD,  and  electrical  power  dis- 
charge modes  applied  to  u combustible  layer. 


For  minimum  impact  energy,  threshold  initiation  on  stainless  steel 
was  used.  Initiation  levels  ranged  from  3.8  ft  lb/in^  for  Ml^-*-*’)  to 
31.6  ft  lb/in2  for  TNT<12»13). 


Frictional  initiation  material  response  values  (TILs)  at  2 ft/sec 
velocity  wer-e  used.  The  values  were  34  kpsi  for  N5  propellant^2),  190 
kpsi  for  TNT^2**3)  and  120  kpsi  for  Ml  propellant. 


Thermal initiation  levels  were  constant  for  TNT  and  N5,  230oc(l2 »13) 
and  150°C^''  respectively.  The  Ml  autoignition  temperature  was  time 
dependent.  After  24  hours  at  120°C,  Ml  will  reportedly  ignite(^)  . This 
was  used  as  the  ignition  temperature  for  a layer  of  Ml.  However,  Ml  will 
reportedly  ignite'16'  at  150°C  after  only  one  hour;  this  was  selected  as 
the  autoignition  temperature  for  the  dust  cloud. 


Similar  variation  existed  for  electrical  ignition,  both  from  ESD  and 
electrical  power  discharge.  Both  TNT  and  N5  in  either  a cloud  or  a laypr 


were  reportedly  ignited  by  0.07^^  However,  Ml  required  only  0.013J 


to  ignite  as  a layer  but  0.024J' 


to  ignite  as  a dust  cloud. 


The  impingement  initiation  threshold  levels  for  these  materials  varied 
from  greater  than  10,000  ft/min  for  Ml  dust  layer^16)  to  38,000  ft/min  for 
•PNt(I2,13)_  For  natural  gas  and  fuel  oil,  thermal,  ESD  and  electrical 
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power  discharge  were  the  initiation  modes  evaluated.  Natural  gas  has  an 
ignition  temperatur^^  about  210°c(^)  aid  an  electrical  ignition 


threshold  of  0.002J' 


Fuel  oil  is  harder  to  ignite  thermally  with  an 


ignition  temperature  of  432 °C^®'  but  is  easier  to  ignite  electrically, 
requiring  only  0.47mj^1*'. 

1 . Hopper 

The  hopper  is  attached  directly  to  the  top  of  the  dual  action  ram 
charger  and  acts  as  a temporary  holding  container  for  the  ingredients. 

The  undesired  event  could  be  caused  by  77  different  minimum 
sequences  of  events  (minimum  cut-sets)  as  shown  in  computer  simulation  of 
the  logic  model.  Potential  initiation  modes  are  summarized  in  Table  III- 
XXVIII  with  their  safety  margins  and  probabilities  and  with  the  maximum 
probability  of  sufficient  flammable  material  existing. 

Two  sequences  are  unacceptable  as  considered,  based  on  the  10“6 
incident  probability.  Both  have  an  overall  probability  of  10"^  and  involve 
a buildup  of  an  explosive  or  propellant  layer  inside  the  hopper  prior  to 
maintenance.  A probability  of  10“^  was  assigned  to  the  existence  of  a 
sufficient  layer  since  its  presence  is  dependent  on  the  operator  not  re- 
moving contaminants  from  inert  material.  An  assumption  was  also  made  that 
no  check  would  be  made  for  the  presence  of  a layer  of  combustible  in  the 
hopper  prior  to  maintenance.  Thermal  or  frictional  initiation  could  occur 
during  maintenance.  A probability  of  1.0  was  assigned  to  this  event.  The 
thermal  initiation  mode  during  welding  would  be  sufficient  to  ignite  any 
explosive  or  propellant.  Frictional  initiation  could  »cr,ur  if  a tool  is 
rubbed  over  a layer  of  combustible  during  maintenance.  Generation  of 
sufficient  energy  from  a frictional  stimulus,  however,  is  dependent  on 
both  the  stresses  developed  at  a particular  applied  velocity  and  the 
explosive  material.  By  conservatively  assuming  that  the  stress  was  three 
times  the  yield  strength  of  SS  316,  both  Ml  and  N5  had  zero  safety  margins, 
and  therefore,  a piobability  of  1.0  that  the  energy  generated  would  be 
sufficient  to  ignite  a combustible  layer.  TNT,  however,  has  a positive 
safety  margin  (0.51)  at  this  stress  and  consequently  a probability  of 
approximately  10"-5.  At  a stress  equal  to  the  yield  strength,  only  N5  had 
a aero  safety  margin;  Ml  and  TNT  had  safety  margins  of  1.86  and  3.52  re- 
spectively with  probabilities  of  10"^  and  10“6  respectively,  that 
sufficient  energy  would  be  generated. 

If  an  examination  was  made  of  the  hopper  to  see  whether  an 
explosive  layer  existed  prior  to  maintenance,  and  the  contaminant  was  re- 
moved, then  a 10 ”4  piobability  would  be  assigned  to  the  existence  of  com- 
bustible which  is  subject  to  initiation  by  thermal  or  frictional  stimulus 
during  maintenance  The  overall  probability  of  the  undesired  event  would 
thus  become  i0“®  and  wi  l be  classified  as  an  acceptable  hazard. 

2 . Dual  Action  Ram  Charger 

The  dual  action  ram  charger  consists  of  two  piston  sections  which 
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operate  in  tandem.  The  first  section  is  the  compacting  section.  It 
receives  feed  from  the  hopper  and  crushes  the  material  by  forward  motion 
of  its  piston.  The  second  section  is  directly  below  the  compacting 
section  and  is  the  feed  s'ction.  It  receives  crushed  ingredients  from  the 
compacting  section  and  pushes  them  into  the  furnace  by  moving  its  piston 
forward.  These  units  are  equipped  with  two  3 hp  drive  motors  actuating 
chain  and  sprocket  driver  rams,  pressure  sensitive  switches  to  prevent 
jamming  and  initiate  recycling,  a flame  detection  device  and  controlled 
water  spray  for  fire  protection  are  also  part  of  the  system. 

Computer  simulation  of  the  logic  model  identified  98  different 
minimum  sequences  of  events  (minimum  cut-sets)  for  each  ram  charger  which 
could  cause  the  undesireu  event.  Potential  initiation  modes  are  summarized 
in  Table  III-XXIX  with  safety  margins  and  probabilities  and  with  the 
maximum  probability  for  the  existence  of  sufficient  flammable  material. 

Three  sequences  are  unacceptable,  based  on  the  10“'^  incident 
probability.  Each  had  an  overall  probability  of  10“^  and  required  build- 
up of  an  expli  sive  or  propellant  layer  inside  the  charger.  The  same 
assumptions  were  made  concerning  buildup  of  this  layer  as  in  the  hopper. 

A probability  of  10“^  was  assigned  to  the  existence  of  a sufficient  com- 
bustible layer  since  its  presence  was  dependent  on  the  operator  not  re- 
moving the  contaminants  from  the  feed  material.  In  addition,  the  assumption 
was  made  that  no  cheek  would  be  made  for  existence  of  a combustible  layer  in 
the  ram  charger  prior  to  either  maintenance  or  normal  operations.  The 
presence  and  sufficiency  of  th?.  same  frictional  and  thermal  initiations 
modes  as  discussed  in  the  hopper  section  apply  here.  Consequently  the  same 
corrective  action  could  be  taken  to  make  them  acceptable  hazards.  The  third 
initiation  stimulus  was  heat  generated  by  the  adjacent  furnace.  Either 
periodic  cleaning  of  the  system,  or  not  opening  the  loading  door  interlock 
until  the  temperature  was  less  than  1Q0°C,  would  be  required  to  make  this 
hazard  acceptable. 

3 . Dual  Chamber  Furnace 

The  dual  chamber  furnace  operates  as  an  induced  draft  incinerator 
and  consists  of  two  vessels  positioned  horizontally,  one  over  the  other. 

The  lower  chamber,  called  the  ignition  chamber,  receives  feed  from  the 
charger  through  an  interlock  loading  door  which  prevents  exposing  the 
charger  to  excessive  temperatures.  It  is  equipped  with  fire  ports  and 
an  intermittent  combustion  blower  and  operates  under  negative  pressure. 

The  second  chamber  is  slightly  smaller  and  is  called  the  combustion 
chamber.  The  ignited  product  is  drawn  from  the  lower  chamber  into  the 
upper  chamber.  The  upper  chamber  is  equipped  with  a constant  combustion 
air  blower  and  a lattice  section  for  mixing  and  reigniting  the  gases. 

One  hundred  twenty-two  different  minimum  sequences  of  events 
(minimum  cut-sets)  were  identified,  via  computer  simulation  of  the  logic 
model,  which  could  cause  the  undesired  event.  A summary  of  potential 
initiation  modes  is  shown  in  Table  III -XXX  with  their  safety  margins  and 
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probabilities  and  with  the  maximum  probability  for  the  presence  of 
sufficient  flammable  materials. 

All  122  sequences  had  probabilities  lo*-  r than  10“6.  The 
principal  reason  for  this  is  the  unlikeliness  . : having  a sufficient 
quantity  of  fuel,  e.g.,  explosive  or  natural  gas,  present.  In  every 
instance,  at  least  two  failures  are  necessary  for  such  an  occurrence. 

For  a contaminating  layer  to  exist,  the  operator  would  have  to  fail  to 
observe  and  remove  the  contaminant  (at  least  a probability  of  10"^)  and 
the  quantity  would  have  to  be  sufficient  (probability  of  10”3) , For  a 
dust  cloud,  the  operator  would  not  observe  and  remove  (again  at  least  a 
probability  of  10"4) , and  the  quantity  would  have  to  be  sufficient  and 
suspended  in  air  (at  least  accidental  10”^  probability).  For  natural  gas 
or  fuel  oil  to  be  present,  a mechanical  failure  (10"^  probability)  is 
required . 

4.  Stack 


The  stack  is  attached  to  the  top  of  the  combustible  chamber  of 
the  furnace.  At  the  top  of  the  stack  is  a stainless  steel  fly  ash 
arrestor . 


Computer  simulation  of  the  logic  model  identified  98  different 
minimum  sequences  of  events  (minimum  cut-sets)  which  could  cause  the 
undesired  event.  Summaries  of  potential  initiation  modes  with  their 
safety  margins  and  probabilities  are  shown  in  Table  1II-XXXI.  The 
maximum  probabilities  for  the  existence  of  sufficient  flammable  material 
are  also  included. 

As  with  the  furnace,  all  sequences  had  probabilities  below  the 
10"6  level.  The  principal  reason  was  the  difficulty  In  having  sufficient 
fuel  present.  Simultaneous  triple  failures  would  be  required  in  all 
instances  for  the  undesired  event  to  occur,  since  the  feed  to  the  stack  is 
the  combustion  products  of  the  furnace.  An  additional  10”4  probability  is 
assigned  to  the  accidental  situation  that  sufficient  fuel,  e.g.,  explosive 
or  natural  gas,  would  not  complete  combustion  in  the  furnace. 
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F,  Hazard J Analysis  Summary  Tables 

The  tables  in  this  section  present  the  potential  modes  of  failures 
and  the  probabilities  associated  with  each,  based  on  the  logic  models 
for  each  of  the  four  subsystems  studied. 

To  determine  the  probability  of  the  undesired  event,  "fire  or 
explosion  results  in  injury  or  death  of  personnel,  or  damage  to  equip- 
ment," for  any  of  the  potential  failure  modes  listed,  multiply  the 
probability  of  a combustible  being  present  times  y,  the  probability  of 
a stimulus  being  of  sufficient  energy  to  cause  initiation,  times  z, 
the  probability  that  the  stimulus  occurs  (this  was  previously  outlined 
on  Figure  III-l,  page  HI-5)  « 

Tables  for  the  four  systems  investigated  are  presented  as  indicated 
below: 


TABLES 

III -II  thru 
III-VIII 

III -IX  thru 
III -XVII 

III-XVIII  thru 
III -XXVII 

III -XXVIII  thru 
III -XXXI 


SYSTEM 

Carbon  Adsorption  System 
Molecular  Sieve  System 
Fluidized  Bed  Incinerator 
Contaminated  Waste  Incinerator 


PAGES 

III-38  thru 
III-51 

I II -52  thru 
III-98 

III-99  thru 
III-145 

III-146  thru 
111-166 
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TABLE  III-IX  (CONT.) 


TABLE  III-X 


SUMMARY  OF  SEQUENCES  OF  EVENTS  WHICH  CAN  CAUSE  FIRE  IN  THE  MIST  ELIMINATOR 
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Summary  of  Controlling  Factors  which  Influence  the  Initiation  of  Flammable 
Cloud  from  Propellant  or  Explosive  Waste  in  Stack 

(Gate  106C) 
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